{"id":13637951,"url":"https://github.com/mbrancato/terraform-google-vault","last_synced_at":"2025-06-18T12:03:54.820Z","repository":{"id":45938381,"uuid":"202469422","full_name":"mbrancato/terraform-google-vault","owner":"mbrancato","description":"Terraform module to deploy Vault as a container on Google Cloud Run","archived":false,"fork":false,"pushed_at":"2021-11-26T09:15:43.000Z","size":29,"stargazers_count":45,"open_issues_count":1,"forks_count":21,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-05-16T10:47:35.859Z","etag":null,"topics":["google-cloud","google-cloud-platform","google-cloud-run","hashicorp-vault","terraform","terraform-modules"],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mbrancato.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-08-15T03:42:21.000Z","updated_at":"2024-12-29T05:49:46.000Z","dependencies_parsed_at":"2022-09-05T16:01:08.010Z","dependency_job_id":null,"html_url":"https://github.com/mbrancato/terraform-google-vault","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/mbrancato/terraform-google-vault","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mbrancato%2Fterraform-google-vault","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mbrancato%2Fterraform-google-vault/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mbrancato%2Fterraform-google-vault/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mbrancato%2Fterraform-google-vault/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mbrancato","download_url":"https://codeload.github.com/mbrancato/terraform-google-vault/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mbrancato%2Fterraform-google-vault/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":260549668,"owners_count":23026298,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["google-cloud","google-cloud-platform","google-cloud-run","hashicorp-vault","terraform","terraform-modules"],"created_at":"2024-08-02T01:00:37.420Z","updated_at":"2025-06-18T12:03:49.804Z","avatar_url":"https://github.com/mbrancato.png","language":"HCL","funding_links":[],"categories":["Tutorials"],"sub_categories":["Security"],"readme":"# Vault Google Cloud Run Module\n\nThis is a Terraform module to deploy a [Vault](https://www.vaultproject.io/)\ninstance on Google's [Cloud Run](https://cloud.google.com/run/) service. Vault\nis an open-source secrets management tool that generally is run in a\nhigh-availability (HA) cluster. This implementation is a single instance\nwith auto-unseal and no HA support. Cloud Run is a way to easily run a\ncontainer on Google Cloud without an orchestrator. This module makes use of the\nfollowing Google Cloud resources:\n\n* Google Cloud Run\n* Google Cloud Storage\n* Google Cloud Key Management Service\n\n---\n## Table of Contents\n\n- [Getting Started](#getting-started)\n- [Variables](#variables)\n  - [`name`](#name)\n  - [`location`](#location)\n  - [`project`](#project)\n  - [`vault_image`](#vault_image)\n  - [`bucket_force_destroy`](#bucket_force_destroy-optional)\n  - [`container_concurrency`](#container_concurrency-optional)\n  - [`vpc_connector`](#vpc_connector-optional)\n  - [`vault_ui`](#vault_ui-optional)\n  - [`vault_api_addr`](#vault_api_addr-optional)\n  - [`vault_kms_keyring_name`](#vault_kms_keyring_name-optional)\n  - [`vault_kms_key_rotation`](#vault_kms_key_rotation-optional)\n  - [`vault_kms_key_algorithm`](#vault_kms_key_algorithm-optional)\n  - [`vault_kms_key_protection_level`](#vault_kms_key_protection_level-optional)\n  - [`vault_service_account_id`](#vault_service_account_id-optional)\n  - [`vault_storage_bucket_name`](#vault_storage_bucket_name-optional)\n- [Security Concerns](#security-concerns)\n- [Caveats](#caveats)\n  - [Google Cloud Container Registry](#google-cloud-container-registry)\n  \n## Getting Started\n\nTo get started, a Google Cloud Project is needed. This should be created ahead\nof time or using Terraform, but is outside the scope of this module. This\nproject ID is provided to the module invocation and a basic implementation\nwould look like the following:\n\n```hcl\nprovider \"google\" {}\n\ndata \"google_client_config\" \"current\" {}\n\nmodule \"vault\" {\n  providers = {\n    google = google\n  }\n\n  source      = \"git::https://github.com/mbrancato/terraform-google-vault.git\"\n  name        = \"vault\"\n  project     = data.google_client_config.current.project\n  location    = data.google_client_config.current.region\n  vault_image = \"us.gcr.io/${data.google_client_config.current.project}/vault:1.6.1\"\n}\n```\n\nAfter creating the resources, the Vault instance may be initialized.\n\nSet the `VAULT_ADDR` environment variable. See [Vault URL](#vault-url).\n\n```\n$ export VAULT_ADDR=https://vault-jsn3uj5s1c-sg.a.run.app\n```\n\nEnsure the vault is operational (might take a minute or two), uninitialized and\nsealed.\n\n```\n$ vault status\nKey                      Value\n---                      -----\nRecovery Seal Type       gcpckms\nInitialized              false\nSealed                   true\nTotal Recovery Shares    0\nThreshold                0\nUnseal Progress          0/0\nUnseal Nonce             n/a\nVersion                  n/a\nHA Enabled               false\n```\n\nInitialize the vault.\n\n```\n$ vault operator init\nRecovery Key 1: ...\nRecovery Key 2: ...\nRecovery Key 3: ...\nRecovery Key 4: ...\nRecovery Key 5: ...\n\nInitial Root Token: s....\n\nSuccess! Vault is initialized\n\nRecovery key initialized with 5 key shares and a key threshold of 3. Please\nsecurely distribute the key shares printed above.\n```\n\nFrom here, Vault is operational. Configure the auth methods needed and other\nsettings. The Cloud Run Service may scale the container to zero, but the server\nconfiguration and unseal keys are configured. When restarting, the Vault should\nunseal itself automatically using the Google KMS. For more information on\ndeploying Vault, read\n[Deploy Vault](https://learn.hashicorp.com/vault/getting-started/deploy).\n\n## Variables\n\n### `name`\n- Application name.\n\n### `location`\n- Google location where resources are to be created.\n\n### `project`\n- Google project ID.\n\n### `vault_image`\n- Vault docker image.\n\n### `bucket_force_destroy` (optional)\n- CAUTION: Set force_destroy for Storage Bucket. This is where the vault data is stored. Setting this to true will allow terraform destroy to delete the bucket.\n  - default - `false`\n\n### `container_concurrency` (optional)\n- Max number of connections per container instance.\n  - default - `80`\n\n### `vpc_connector` (optional)\n- ID for the [Serverless VPC connector](https://cloud.google.com/vpc/docs/configure-serverless-vpc-access) to be used, if any, for private VPC access.\n  - Creation of the connector is out of scope of this module, see [google_vpc_access_connector](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/vpc_access_connector).\n  - default - `null`\n\n### `vault_ui` (optional)\n- Enable Vault UI.\n  - default - `false`\n\n### `vault_api_addr` (optional)\n- Full HTTP endpoint of Vault Server if using a custom domain name. Leave blank otherwise.\n  - default - `\"\"`\n\n### `vault_kms_keyring_name` (optional)\n- Name of the Google KMS keyring to use.\n  - default - `\"${var.name}-${lower(random_id.vault.hex)}-kr\"`\n\n### `vault_kms_key_rotation` (optional)\n- The period for KMS key rotation.\n  - Note: key rotations will lead to multiple active KMS keys and will result in an increasing monthly bill. Setting to `null` should disable rotation (not recommended).\n  - default - `\"7776000s\"` (90 days)\n\n### `vault_kms_key_algorithm` (optional)\n- The cryptographic algorithm to be used with the KMS key.\n  - Specify a supported [CryptoKeyVersionAlgorithm](https://cloud.google.com/kms/docs/reference/rest/v1/CryptoKeyVersionAlgorithm) value.\n  - default - `\"GOOGLE_SYMMETRIC_ENCRYPTION\"`\n\n### `vault_kms_key_protection_level` (optional)\n- The protection level to be used with the KMS key.\n  - Specify the [protection level](https://cloud.google.com/kms/docs/algorithms#protection_levels) to be used (SOFTWARE, HSM, EXTERNAL).\n  - default - `\"SOFTWARE\"`\n\n### `vault_service_account_id` (optional)\n- ID for the service account to be used. This is the part of the service account email before the `@` symbol.\n  - default - `\"vault-sa\"`\n\n### `vault_storage_bucket_name` (optional)\n- Storage bucket name to be used.\n  - default - `\"${var.name}-${lower(random_id.vault.hex)}-bucket\"`\n\n## Security Concerns\n\nThe following things may be of concern from a security perspective:\n\n* When not using a VPC connector, this is a publicly accessible Vault instance. Anyone with the DNS name can connect to it.\n* By default, Vault is running on shared compute infrastructure. The [Google Terraform provider](https://github.com/hashicorp/terraform-provider-google) does not yet support Cloud Run on Anthos / GKE to deploy on single-tenant VMs.\n\n## Caveats\n\n**PLEASE READ**\n\n### Google Cloud Container Registry\n\nCloud Run will only run containers hosted on `gcr.io` (GCR) and its subdomains.\nThis means that the Vault container will need to be pushed to GCR in the Google\nCloud Project. Terraform cannot currently create the container registry and it\nis automatically created using `docker push`. Read the\n[documentation](https://cloud.google.com/container-registry/docs/pushing-and-pulling)\nfor more details on pushing containers to GCR.\n\nA quick way to get Vault into GCR for a GCP project:\n\n```\ngcloud auth configure-docker\ndocker pull hashicorp/vault:latest\ndocker tag hashicorp/vault:1.6.1 gcr.io/{{ project_id }}/vault:1.6.1\ndocker push gcr.io/{{ project_id }}/vault:1.6.1\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmbrancato%2Fterraform-google-vault","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmbrancato%2Fterraform-google-vault","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmbrancato%2Fterraform-google-vault/lists"}