{"id":15679295,"url":"https://github.com/joatmon08/hashicorp-aws-zero-trust","last_synced_at":"2025-07-26T10:37:43.289Z","repository":{"id":112736836,"uuid":"421580282","full_name":"joatmon08/hashicorp-aws-zero-trust","owner":"joatmon08","description":"Using HashiCorp Boundary, Vault, and Consul with Amazon ECS","archived":false,"fork":false,"pushed_at":"2022-01-28T15:31:25.000Z","size":150,"stargazers_count":12,"open_issues_count":0,"forks_count":3,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-05-07T09:43:42.446Z","etag":null,"topics":["aws","boundary","consul","containers","ecs","hashicorp","terraform","vault"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/joatmon08.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-10-26T20:50:55.000Z","updated_at":"2024-04-14T13:04:02.000Z","dependencies_parsed_at":null,"dependency_job_id":"70b3c674-02e1-4700-8a1a-5ab917055f98","html_url":"https://github.com/joatmon08/hashicorp-aws-zero-trust","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/joatmon08/hashicorp-aws-zero-trust","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/joatmon08%2Fhashicorp-aws-zero-trust","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/joatmon08%2Fhashicorp-aws-zero-trust/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/joatmon08%2Fhashicorp-aws-zero-trust/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/joatmon08%2Fhashicorp-aws-zero-trust/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/joatmon08","download_url":"https://codeload.github.com/joatmon08/hashicorp-aws-zero-trust/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/joatmon08%2Fhashicorp-aws-zero-trust/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":267150480,"owners_count":24043473,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-26T02:00:08.937Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","boundary","consul","containers","ecs","hashicorp","terraform","vault"],"created_at":"2024-10-03T16:28:24.175Z","updated_at":"2025-07-26T10:37:43.253Z","avatar_url":"https://github.com/joatmon08.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# HashiCorp Zero Trust Foundations on AWS\n\nThis example demonstrates how HashiCorp tools run on AWS, including:\n\n1. Boundary\n1. HashiCorp Cloud Platform Vault\n1. HashiCorp Cloud Platform Consul\n1. Terraform Cloud\n\nIt uses the following AWS services:\n\n1. Amazon ECS\n1. AWS KMS\n\n## Usage\n\nTo run this example, you need Terraform Cloud to set up a series of workspaces.\nThe workspaces need to be set up as follows, with the appropriate working directory, secrets,\nand remote workspace sharing.\n\n| Workspace Name | Working Directory for VCS | Variables | Remote State Sharing |\n| ----------- | ----------- | ----------- | ----------- |\n| hcp      | `hcp/` | name, trusted_role_arn, bootstrap AWS access keys, HCP credentials | infrastructure, consul, boundary, vault-aws |\n| vault-aws      | `vault/aws/` | name, AWS access keys (for AWS secrets engine) |  |\n| infrastructure      | `infrastructure/` | name, client_cidr_block, HCP service principal credentials, database_password, boundary_database_password, key_pair_name. [FROM VAULT] AWS access keys | boundary, apps, vault-products |\n| vault-products | `vault/products/` | name, HCP service principal credentials | boundary |\n| boundary      | `boundary/` | name. [FROM VAULT] db_password, db_username, AWS access keys | |\n| apps      | `apps/` | name, client_cidr_block. [FROM VAULT] db_password, db_username, AWS access keys | |\n\nYou need to run plan and apply for each workspace in the order indicated.\n\n## AWS secrets engine for Vault\n\nImagine you want to issue AWS access keys for each group that runs Terraform. You can use\nVault's AWS secrets engine to generate access keys for each group.\n\nFor example, you set up an initial AWS access and secret key for Vault to issue new\ncredentials. The AWS access and secret key assume a role with sufficient permissions\nfor Terraform to configure infrastructure on AWS.\n\n1. Run `terraform apply` for the `hcp` workspace. It creates:\n    - HCP network\n    - HCP Vault cluster\n    - HCP Consul cluster\n    - AWS IAM Role for Terraform\n\n1. Sets the Vault address, token, and namespace for you to get\n   a new set of AWS access keys from Vault in your CLI.\n   ```shell\n   source set.sh\n   ```\n\n1. Next, generate a set of AWS access keys for the Vault secrets engine. These should be\n   different than the ones you used to bootstrap HCP and the AWS IAM role!\n\n1. Add the new AWS access keys to `vault-aws` workspace.\n\n1. Run `terraform apply` for the `vault-aws` workspace. It creates:\n    - Path for AWS secrets engine in Vault at `terraform/aws`\n    - Role for your team (e.g., `hashicups`)\n\n1. Run `make vault-aws`. This retrieves a new set of AWS access keys from Vault via\n   the secrets engine and saves it to the `secrets/` directory locally.\n   ```shell\n   make vault-aws\n   ```\n\n1. Use the AWS access and secret keys from `secrets/aws.json` and add them to the\n   `infrastructure`, `boundary`, and `apps` workspaces.\n\n1. Run `terraform apply` for the `infrastructure` workspace. It creates:\n    - AWS VPC and peers to HCP network\n    - HashiCups database (PostgreSQL)\n    - Boundary cluster (1 worker, 1 controller, database)\n    - Amazon ECS cluster (1 EC2 container instance)\n\n## Secrets for the Products API\n\nWe need to generate a few things for the products API (and Boundary).\n\n- Database secrets engine for HashiCups data (used by `product-api` and Boundary)\n- AWS IAM Auth Method for `vault-agent` in HashiCups `product-api`\n\nTo configure this, you need to add HCP service credentials with the Vault address, token, and\nnamespace to `vault-products`.\n\nYou have two identities that need to access the application's database:\n\n1. Application (`product-api`) to __read from__ the database\n1. Human user (`ops` or `dev` team) to __update__ the database using Boundary\n\nConfigure the following.\n\n1. Run `terraform apply` for the `vault-products` workspace. It creates:\n    - Path for database credentials in Vault at `hashicups/database`\n    - Role for the application that will access it (e.g., `product`)\n    - Role for Boundary user to access it (e.g., `boundary`)\n## Configuring Boundary\n\nBoundary needs a set of organizations and projects. You have two projects:\n\n1. `core_infra`: ECS container instance. Allow `ops` team to SSH into it.\n1. `product_infra`: Application database. Allow `ops` or `dev` team to configure it.\n\nConfigure the following.\n\n1. Run `terraform apply` for the `boundary` workspace. It creates:\n    - Two projects, one for `core_infra` and the other for `product_infra`.\n    - Three users, `jeff` for the `ops` team, `rosemary` for the `dev` team,\n      and `taylor` for the `security` team.\n    - Two targets:\n        - ECS container instance (not yet added)\n        - Application database, brokered by Vault credentials\n\n### Dynamic Host Catalog\n\n1. Run `source set.sh` to set your Boundary address.\n\n1. Run `make boundary-host-catalog` to configure the host catalog for the ECS container instances.\n   This uses dynamic host catalog plugins in Boundary to auto-discover AWS EC2 instances with the cluster\n   tag.\n\n1. You can also SSH into the ECS container instance as the `ops` team. Run `make ssh-ecs`.\n\n### Vault Credentials Brokering\n\n1. Boundary uses Vault as a credentials store to retrieve a new set of database credentials!\n   Run `make configure-db` to log into Boundary as the `dev` team and configure the database -\n   all without knowing the username or password!\n\n## Consul intentions\n\nYou may need to control network policy between services on ECS and other services\nregistered to Consul. You can use intentions to secure service-to-service communication.\n\n1. Run `terraform apply` for the `apps` workspace. It creates three ECS services:\n    1. `frontend` (Fargate launch type)\n    1. `public-api` (Fargate launch type)\n    1. `product-api` (EC2 launch type)\n\n1. Run `terraform apply` for the `vault-products` workspace. It adds:\n    - AWS IAM authentication method for ECS task to authenticate to vault\n\n1. Run `make products` to mark the `product-api` to be recreated.\n\n1. Run `terraform apply` for the `apps` workspace. It should redeploy the `product-api`.\n\n1. Try to access the frontend via the ALB. You might get an error! We need to enable\n   traffic between the services registered to Consul.\n\n1. Try to access the frontend via the ALB. You'll get a `Packer Spiced Latte`!","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjoatmon08%2Fhashicorp-aws-zero-trust","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjoatmon08%2Fhashicorp-aws-zero-trust","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjoatmon08%2Fhashicorp-aws-zero-trust/lists"}