{"id":29111406,"url":"https://github.com/plus3it/terraform-aws-vault","last_synced_at":"2025-06-29T09:32:59.601Z","repository":{"id":35684715,"uuid":"195857211","full_name":"plus3it/terraform-aws-vault","owner":"plus3it","description":"Terraform module that installs and configures Hashicorp Vault cluster with HA DynamoDB storage backend.","archived":false,"fork":false,"pushed_at":"2025-06-16T03:00:52.000Z","size":407,"stargazers_count":3,"open_issues_count":0,"forks_count":8,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-06-16T04:29:02.939Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/plus3it.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2019-07-08T17:26:32.000Z","updated_at":"2025-06-16T03:00:54.000Z","dependencies_parsed_at":"2023-11-13T03:24:58.079Z","dependency_job_id":"35dc520c-0686-4d38-92c5-21300e7212e8","html_url":"https://github.com/plus3it/terraform-aws-vault","commit_stats":null,"previous_names":[],"tags_count":12,"template":false,"template_full_name":null,"purl":"pkg:github/plus3it/terraform-aws-vault","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fterraform-aws-vault","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fterraform-aws-vault/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fterraform-aws-vault/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fterraform-aws-vault/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/plus3it","download_url":"https://codeload.github.com/plus3it/terraform-aws-vault/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fterraform-aws-vault/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":262569953,"owners_count":23330318,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-29T09:32:19.894Z","updated_at":"2025-06-29T09:32:59.587Z","avatar_url":"https://github.com/plus3it.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n# Vault AWS Terraform Module \n\n## `terraform-aws-vault`\n\n\n## Overview\n\nThis Terraform module installs and configures the Hashicorp Vault cluster with HA DyanamoDb storage backend. This module is built on top of the `terraform-aws-watchmaker` module. You can quickly deploy a single instance of Vault or an auto-scaled group of Vault instances.\n\nThis module uses AWS DynamoDB as the storage backend to persist Vault's data. AWS DynamoDB storage backend supports High Availablity (HA) and also Point-In-Time-Recovery ([PITR](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/PointInTimeRecovery_Howitworks.html)) capability.\n\nThis module, by default, deploys a Watchmaker Linux AutoScaling Group with a minimum group size of 2 instances running on `STIG-Partitioned Enterprise Linux (SPEL) Centos 7` Amazon Machine Image (AMI) distributed by [Plus3 IT Systems](https://github.com/plus3it). `spel` is a project that helps create and publish Enterprise Linux images that are partitioned according to the [DISA STIG](http://iase.disa.mil/stigs/os/unix-linux/Pages/red-hat.asp). To learn more about `spel` visit our project space [here](https://github.com/plus3it/spel).\n\n* For more information on using `terraform-aws-watchmaker`, go to \u003chttps://registry.terraform.io/modules/plus3it/watchmaker\u003e.\n* For more information on installing and using `watchmaker`, go to \u003chttps://watchmaker.readthedocs.io\u003e.\n\n## How To Navigate This Module\n\nThis repo is structured as follows:\n\n* [Root](https://github.com/plus3it/terraform-aws-vault/tree/master): This folder contains a standalone, reusable, production-grade module that you can use to deploy a single Vault instance or a cluster of Vault instances that are partitioned according to the [DISA STIG[(http://iase.disa.mil/stigs/os/unix-linux/Pages/red-hat.aspx) with the help of `[watchmaker](https://github.com/plus3it/watchmaker)`.\n* [Modules](https://github.com/plus3it/terraform-aws-vault/tree/master/modules/): The folder contains an IAM module that manages the IAM Roles and permissions required for this module to work correctly.\n\n* [Policies](https://github.com/plus3it/terraform-aws-vault/tree/master/policies): This folder contains policies that can be referred to by the resources.\n\n* [Salt](https://github.com/plus3it/terraform-aws-vault/tree/master/salt): This folder contains the `saltstack` modules and states to apply the pre-defined configuration to Vault instances.\n\n* [Scripts](https://github.com/plus3it/terraform-aws-vault/tree/master/scripts): This folder contains the scripts to help with bootstrapping the application by retrieving the salt modules and pillar information from S3 and then run `salt-call` on the local minion.\n\n* [Tests](https://github.com/plus3it/terraform-aws-vault/tree/master/tests): This folder contains the test cases as well as examples of how to implement this module.\n\n## Usage\n\n1. Create a `main.auto.tfvars`  file. See [`variables.tf`](variables.tf) for the required and optional variables. This file is ignored intentionally by source control so it is not committed to the project.\n2. Create `pillar` folder and files in the following structure.\n```\n├── pillar\n│   ├── top.sls\n│   └── vault\n│       └── init.sls\n``` \n\u003e **NOTE**: See [`tests\\vault-py2\\pillar`](tests\\vault-py2\\pillar) for an example on how to structure the `pillar` folder.\n\n3. Then run the following command to deploy the module:\n* `terraform init` (first time only)\n* `terraform plan`\n* `terraform apply`\n\n## Pillar\nThis module uses SaltStack to handle the configuration of the Vault instances. We are going to use [`salt pillar`](https://docs.saltstack.com/en/getstarted/config/pillar.html ) to hold all configurations that will persist to the Vault minion. With `salt pillar`, users can securely define data/settings that are assigned to the minions. Users can store configuration settings such as values ports, file paths, configuration parameters, passwords, and much more to `salt pillar`. \n\nAll Vault's configuration settings, such as authentication methods, secrets engines, audit devices, and policies, will be stored in `pillar`. Once the bootstrap script finished installing and configuring on the elastic computing instance, several custom salt state modules will be called to persist all settings that were defined in the `pillar` to Vault's HA DynamoDB storage backend. \n\nExample:\n```yaml\nvault:\n  lookup:\n    # These pillar items are templated by the Terraform `template_dir` resource: [https://www.terraform.io/docs/providers/template/r/dir.html]\n    # Input vars can be defined and provided to the module through the `terraform.auto.tfvar` file.\n    # See `variables.var` file for more information on each variables.\n    api_port:  ${api_port}\n    cluster_port:  ${cluster_port}\n    dynamodb_table:  ${dynamodb_table}\n    inbound_cidrs:  ${inbound_cidrs}\n    kms_key_id:  ${kms_key_id}\n    logs_path:  ${logs_path}\n    logs_dir:  ${logs_dir}\n    region:  ${region}\n    ssm_path:  ${ssm_path}\n    version:  ${vault_version}\n\n    secrets_engines:\n      - type:  kv\n        path:  services\n        description:  Sevices specific folders\n        config:\n          default_lease_ttl:  1800\n          max_lease_ttl:  1800\n        secret_config: ${secrets_kv_config}\n      # Additional secrets engines can be configure here\n\n\n    auth_methods:\n      - type:  token\n        path:  token\n        description:  token based credentials\n        config:\n          default_lease_ttl:  0\n          max_lease_ttl:  0\n        auth_config: ${auth_token_config}\n      # Additional authentication methods can be configure here\n\n\n    audit_devices:\n      - type:  file\n        path:  file_log\n        description:  first audit device\n        config:\n        file_path:  /etc/vault/logs/audit.log\n      # Additional audit devices can be configure here\n\n    policies:\n      # Following example of vault policy from https://learn.hashicorp.com/vault/identity-access-management/iam-policies\n      admin:\n        path:\n          # Manage ad secret engines broadly across Vault\n          'ad/*': {capabilities: [create, read, update, delete, list, sudo]}\n          # Manage auth methods broadly across Vault\n          'auth/*': {capabilities: [create, read, update, delete, list, sudo]}\n```\n\u003e ***Note***: Additional configurations can be specified for authentication methods using the `auth_config` pillar item. This also applies for secrets engines. Specifying the configuration for a particular secrets engine under the `secret_config` pillar item of that secrets engine type.\n\nIn some use cases, passwords or sensitive information will need to be provided in order for Vault to communicate and function properly. For instance, when enabling the [Active Directory Secrets Engine](https://www.vaultproject.io/api/secret/ad/index.html), you need to specify the url of the LDAP server, a bind_dn and a bind_pass to perform user search. This information will need to be hidden from the public and only available to `salt` when it synchronizes the configs. One way to specify these config is via the input  `vault_pillar_extra_config` variable within the `terraform.auto.tfvar` file.\n\nExample:\n`terraform.auto.tfvar` file:\n```terraform\ntemplate_vars = {\n  auth_ldap_config = {\n    user_dn =  \"CN=Users,DC=ad,DC=example,DC=com\"\n    group_dn =  \"CN=Users,DC=ad,DC=example,DC=com\"\n    url =  \"ldaps://ad.example.com\"\n    insecure_tls =  true\n    user_attr =  \"cn\"\n    group_attr =  \"memberOf\"\n    group_filter =  \"{{ '(\u0026(objectClass=person)(cn={{.Username}}))' | yaml }}\"\n  },\n  auth_ldap_extra_config = {\n    group_policy_map = {\n      acb_admin = {\n        name     = \"administrator\",\n        policies = [\"admin\"]\n      }\n    }\n  }\n}\n```\n`init.sls` pillar file:\n```yaml \nauth_methods:\n  - type:  ldap\n    path:  ldap\n    description:  LDAP Auth\n    config:\n      default_lease_ttl:  1800\n      max_lease_ttl:  1800\n    secret_config:  ${auth_ldap_config}\n    extra_config: ${auth_ldap_extra_config}\n```\n\n\u003e ***Note***: You can use the `${type_name_config}` pattern to reference the config specified in the `template_vars` input var. \n\n## Vault Salt State Modules\nThis module contains several custom salt state modules to help with syncronizing Vault's configurations. Base on the values defined in the `pillar`, these custom state modules will enable, disable, or tune the configurations of Vault's auth methods, secrets engines, audit devices, and policies. The custom state modules interact with the Vault API endpoints via Python 2.7/3.x Hashicorp Vault API Client ([`hvac`](https://hvac.readthedocs.io/)). See details for each custom state module below:\n\n#### `vault.secret_engines_synced` \nThis state module responsible for syncronizing secrets engines configurations between the pillar and the remote Vault instances. The module will look for configuration within the key `secrets_engines` from the pillar. Specify configuration for the secrets engine within this key. \nExample:\n```yaml\nsync_secrets_engines:\n  vault.secret_engines_synced:\n    -  configs: {{ vault.secrets_engines | yaml }}\n```\n#### `vault.auth_methods_synced`\nThis state module responsible for syncronizing authentication methods configurations between the pillar and the remote Vault instances. The module will look for configuration within the key `auth_methods` from the pillar. Specify configuration for each auth method within this key. \nExample:\n```yaml\nsync_authentication_methods:\n  vault.auth_methods_synced:\n    -  configs: {{ vault.auth_methods | yaml }}\n```\n#### `vault.audit_devices_synced`\nThis state module responsible for syncronizing audit devices configurations between the pillar and the remote Vault instances. The module will look for configuration within the key `audit_devices` from the pillar. Specify configuration for each audit device within this key. \nExample:\n```yaml\nsync_audit_devices:\n  vault.audit_devices_synced:\n    - configs: {{ vault.audit_devices | yaml }}\n```\n#### `vault.policies_synced`\nThis state module responsible for synchronizing policies between the pillar and the remote Vault instances. The module will look for configuration within the key `policies` from the pillar. Specify configuration for each policy within this key. \nExample:\n```yaml\nsync_policies:\n  vault.policies_synced:\n    - policies: {{ vault.policies | yaml }}\n```\n\n\u003c!-- BEGIN TFDOCS --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 0.12 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_archive\"\u003e\u003c/a\u003e [archive](#provider\\_archive) | n/a |\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | n/a |\n| \u003ca name=\"provider_local\"\u003e\u003c/a\u003e [local](#provider\\_local) | n/a |\n| \u003ca name=\"provider_random\"\u003e\u003c/a\u003e [random](#provider\\_random) | n/a |\n| \u003ca name=\"provider_template\"\u003e\u003c/a\u003e [template](#provider\\_template) | n/a |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [archive_file.pillar](https://registry.terraform.io/providers/hashicorp/archive/latest/docs/data-sources/file) | data source |\n| [archive_file.salt](https://registry.terraform.io/providers/hashicorp/archive/latest/docs/data-sources/file) | data source |\n| [aws_ami.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |\n| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |\n| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |\n| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |\n| [aws_route53_zone.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53_zone) | data source |\n| [aws_subnet.lb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnet) | data source |\n| [template_file.appscript](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_ami_owners\"\u003e\u003c/a\u003e [ami\\_owners](#input\\_ami\\_owners) | (Required) Account id/alias of the AMI owners | `list(string)` | n/a | yes |\n| \u003ca name=\"input_domain_name\"\u003e\u003c/a\u003e [domain\\_name](#input\\_domain\\_name) | (Required) The domain name where vault url will be registered to. Example: domain.net | `string` | n/a | yes |\n| \u003ca name=\"input_ec2_subnet_ids\"\u003e\u003c/a\u003e [ec2\\_subnet\\_ids](#input\\_ec2\\_subnet\\_ids) | (Required) List of subnets where EC2 instances will be launched | `list(string)` | n/a | yes |\n| \u003ca name=\"input_environment\"\u003e\u003c/a\u003e [environment](#input\\_environment) | (Required) Type of environment -- must be one of: dev, test, prod | `string` | n/a | yes |\n| \u003ca name=\"input_key_pair_name\"\u003e\u003c/a\u003e [key\\_pair\\_name](#input\\_key\\_pair\\_name) | (Required) Keypair to associate to launched instances | `string` | n/a | yes |\n| \u003ca name=\"input_lb_subnet_ids\"\u003e\u003c/a\u003e [lb\\_subnet\\_ids](#input\\_lb\\_subnet\\_ids) | (Required) List of subnets to associate to the Load Balancer | `list(string)` | n/a | yes |\n| \u003ca name=\"input_name\"\u003e\u003c/a\u003e [name](#input\\_name) | (Required) Name of the vault stack, will be use to prefix resources | `string` | n/a | yes |\n| \u003ca name=\"input_route53_zone_id\"\u003e\u003c/a\u003e [route53\\_zone\\_id](#input\\_route53\\_zone\\_id) | (Required) Hosted zone ID Route 53 hosted zone | `string` | n/a | yes |\n| \u003ca name=\"input_vault_pillar_path\"\u003e\u003c/a\u003e [vault\\_pillar\\_path](#input\\_vault\\_pillar\\_path) | (Required) Specify the path to vault pillar | `string` | n/a | yes |\n| \u003ca name=\"input_vault_version\"\u003e\u003c/a\u003e [vault\\_version](#input\\_vault\\_version) | (Required) Version of Vault to be installed on servers | `string` | n/a | yes |\n| \u003ca name=\"input_ami_name_filters\"\u003e\u003c/a\u003e [ami\\_name\\_filters](#input\\_ami\\_name\\_filters) | (Optional) Will be use to filter out AMI | `list(string)` | \u003cpre\u003e[\u003cbr/\u003e  \"spel-minimal-centos-7-hvm-*.x86_64-gp2\"\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_ami_name_regex\"\u003e\u003c/a\u003e [ami\\_name\\_regex](#input\\_ami\\_name\\_regex) | (Optional) Regex to help fine-grain filtering AMI | `string` | `\"spel-minimal-centos-7-hvm-\\\\d{4}\\\\.\\\\d{2}\\\\.\\\\d{1}\\\\.x86_64-gp2\"` | no |\n| \u003ca name=\"input_api_port\"\u003e\u003c/a\u003e [api\\_port](#input\\_api\\_port) | (Optional) The port to use for Vault API calls | `number` | `8200` | no |\n| \u003ca name=\"input_certificate_arn\"\u003e\u003c/a\u003e [certificate\\_arn](#input\\_certificate\\_arn) | (Optional) The ARN of the default SSL server certificate to be use for HTTPS lb listener. | `string` | `null` | no |\n| \u003ca name=\"input_cfn_bootstrap_utils_url\"\u003e\u003c/a\u003e [cfn\\_bootstrap\\_utils\\_url](#input\\_cfn\\_bootstrap\\_utils\\_url) | (Optional) URL to aws-cfn-bootstrap-latest.tar.gz | `string` | `\"https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-latest.tar.gz\"` | no |\n| \u003ca name=\"input_cfn_endpoint_url\"\u003e\u003c/a\u003e [cfn\\_endpoint\\_url](#input\\_cfn\\_endpoint\\_url) | (Optional) URL to the CloudFormation Endpoint. e.g. https://cloudformation.us-east-1.amazonaws.com | `string` | `\"https://cloudformation.us-east-1.amazonaws.com\"` | no |\n| \u003ca name=\"input_cloudwatch_agent_url\"\u003e\u003c/a\u003e [cloudwatch\\_agent\\_url](#input\\_cloudwatch\\_agent\\_url) | (Optional) S3 URL to CloudWatch Agent installer. Example: s3://amazoncloudwatch-agent/linux/amd64/latest/AmazonCloudWatchAgent.zip | `string` | `\"\"` | no |\n| \u003ca name=\"input_cluster_port\"\u003e\u003c/a\u003e [cluster\\_port](#input\\_cluster\\_port) | (Optional) The port to use for Vault server-to-server communication. | `number` | `8201` | no |\n| \u003ca name=\"input_desired_capacity\"\u003e\u003c/a\u003e [desired\\_capacity](#input\\_desired\\_capacity) | (Optional) Desired number of instances in the Autoscaling Group | `string` | `\"2\"` | no |\n| \u003ca name=\"input_dynamodb_max_read_capacity\"\u003e\u003c/a\u003e [dynamodb\\_max\\_read\\_capacity](#input\\_dynamodb\\_max\\_read\\_capacity) | (Optional) The max capacity of the scalable target for DynamoDb table autoscaling. | `number` | `100` | no |\n| \u003ca name=\"input_dynamodb_min_read_capacity\"\u003e\u003c/a\u003e [dynamodb\\_min\\_read\\_capacity](#input\\_dynamodb\\_min\\_read\\_capacity) | (Optional) The min capacity of the scalable target for DynamoDb table autoscaling. | `number` | `5` | no |\n| \u003ca name=\"input_dynamodb_table\"\u003e\u003c/a\u003e [dynamodb\\_table](#input\\_dynamodb\\_table) | (Optional) Name of the Dynamodb to be used as storage backend for Vault | `string` | `null` | no |\n| \u003ca name=\"input_dynamodb_target_value\"\u003e\u003c/a\u003e [dynamodb\\_target\\_value](#input\\_dynamodb\\_target\\_value) | (Optional) The target value for the metric of the scaling policy configuration. | `number` | `70` | no |\n| \u003ca name=\"input_ec2_extra_security_group_ids\"\u003e\u003c/a\u003e [ec2\\_extra\\_security\\_group\\_ids](#input\\_ec2\\_extra\\_security\\_group\\_ids) | (Required) List of additional security groups to add to EC2 instances | `list(string)` | `[]` | no |\n| \u003ca name=\"input_enabled_repos\"\u003e\u003c/a\u003e [enabled\\_repos](#input\\_enabled\\_repos) | (Optional) List of repos to be enabled with yum-config-manager. Epel repo will be enabled by default. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_inbound_cidrs\"\u003e\u003c/a\u003e [inbound\\_cidrs](#input\\_inbound\\_cidrs) | (Optional) IP address or range of addresses to be allowed to Firewall Zone. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_ingress_cidr_blocks\"\u003e\u003c/a\u003e [ingress\\_cidr\\_blocks](#input\\_ingress\\_cidr\\_blocks) | (Optional) List of CIDR block. | `list(string)` | \u003cpre\u003e[\u003cbr/\u003e  \"0.0.0.0/0\"\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_instance_type\"\u003e\u003c/a\u003e [instance\\_type](#input\\_instance\\_type) | (Optional) Amazon EC2 instance type | `string` | `\"t2.medium\"` | no |\n| \u003ca name=\"input_kms_key_id\"\u003e\u003c/a\u003e [kms\\_key\\_id](#input\\_kms\\_key\\_id) | (Optional) Id of an AWS KMS key use for auto unseal operation when vault is intialize | `string` | `null` | no |\n| \u003ca name=\"input_lb_internal\"\u003e\u003c/a\u003e [lb\\_internal](#input\\_lb\\_internal) | (Optional) Boolean indicating whether the load balancer is internal or external | `bool` | `true` | no |\n| \u003ca name=\"input_lb_ssl_policy\"\u003e\u003c/a\u003e [lb\\_ssl\\_policy](#input\\_lb\\_ssl\\_policy) | (Optional) The name of the SSL Policy for the listener | `string` | `\"ELBSecurityPolicy-FS-2018-06\"` | no |\n| \u003ca name=\"input_max_capacity\"\u003e\u003c/a\u003e [max\\_capacity](#input\\_max\\_capacity) | (Optional) Maximum number of instances in the Autoscaling Group | `string` | `\"2\"` | no |\n| \u003ca name=\"input_min_capacity\"\u003e\u003c/a\u003e [min\\_capacity](#input\\_min\\_capacity) | (Optional) Minimum number of instances in the Autoscaling Group | `string` | `\"1\"` | no |\n| \u003ca name=\"input_override_json\"\u003e\u003c/a\u003e [override\\_json](#input\\_override\\_json) | (Optional) Override the current policy document | `string` | `\"\"` | no |\n| \u003ca name=\"input_point_in_time_recovery\"\u003e\u003c/a\u003e [point\\_in\\_time\\_recovery](#input\\_point\\_in\\_time\\_recovery) | (Optional) Enabling Amazon DynamoDB point-in-time recovery (PITR) provides automatic backups of your DynamoDB table data. | `bool` | `true` | no |\n| \u003ca name=\"input_pypi_index_url\"\u003e\u003c/a\u003e [pypi\\_index\\_url](#input\\_pypi\\_index\\_url) | (Optional) URL to the PyPi Index | `string` | `\"https://pypi.org/simple\"` | no |\n| \u003ca name=\"input_scale_down_schedule\"\u003e\u003c/a\u003e [scale\\_down\\_schedule](#input\\_scale\\_down\\_schedule) | (Optional) Scheduled Action in cron-format (UTC) to scale down to MinCapacity; ignored if empty or ScaleUpSchedule is unset (E.g. '0 0 * * *') | `string` | `null` | no |\n| \u003ca name=\"input_scale_up_schedule\"\u003e\u003c/a\u003e [scale\\_up\\_schedule](#input\\_scale\\_up\\_schedule) | (Optional) Scheduled Action in cron-format (UTC) to scale up to MaxCapacity; ignored if empty or ScaleDownSchedule is unset (E.g. '0 10 * * Mon-Fri') | `string` | `null` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | (Optional) List of tags to include with resource | `map(string)` | `{}` | no |\n| \u003ca name=\"input_template_vars\"\u003e\u003c/a\u003e [template\\_vars](#input\\_template\\_vars) | (Optional) List extra configurations to be referenced in the pillar | `map` | `{}` | no |\n| \u003ca name=\"input_toggle_update\"\u003e\u003c/a\u003e [toggle\\_update](#input\\_toggle\\_update) | (Optional) Toggle that triggers a stack update by modifying the launch config, resulting in new instances; must be one of: A or B | `string` | `\"A\"` | no |\n| \u003ca name=\"input_vault_url\"\u003e\u003c/a\u003e [vault\\_url](#input\\_vault\\_url) | (Optional) The DNS address that vault will be accessible at. Stack name will be used as the url when value is set to empty. Example: vault.domain.net | `string` | `null` | no |\n| \u003ca name=\"input_watchmaker_admin_groups\"\u003e\u003c/a\u003e [watchmaker\\_admin\\_groups](#input\\_watchmaker\\_admin\\_groups) | (Optional) Colon-separated list of domain groups that should have admin permissions on the EC2 instance | `string` | `\"\"` | no |\n| \u003ca name=\"input_watchmaker_admin_users\"\u003e\u003c/a\u003e [watchmaker\\_admin\\_users](#input\\_watchmaker\\_admin\\_users) | (Optional) Colon-separated list of domain users that should have admin permissions on the EC2 instance | `string` | `\"\"` | no |\n| \u003ca name=\"input_watchmaker_config\"\u003e\u003c/a\u003e [watchmaker\\_config](#input\\_watchmaker\\_config) | (Optional) URL to a Watchmaker config file | `string` | `\"\"` | no |\n| \u003ca name=\"input_watchmaker_ou_path\"\u003e\u003c/a\u003e [watchmaker\\_ou\\_path](#input\\_watchmaker\\_ou\\_path) | (Optional) DN of the OU to place the instance when joining a domain. If blank and WatchmakerEnvironment enforces a domain join, the instance will be placed in a default container. Leave blank if not joining a domain, or if WatchmakerEnvironment is false | `string` | `\"\"` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_vault_url\"\u003e\u003c/a\u003e [vault\\_url](#output\\_vault\\_url) | URL to access Vault UI |\n\n\u003c!-- END TFDOCS --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplus3it%2Fterraform-aws-vault","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fplus3it%2Fterraform-aws-vault","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplus3it%2Fterraform-aws-vault/lists"}