terraform: make ELB, docs

terraform/aws/README.md

@@ -0,0 +1,8 @@
+# Deploy Vault to AWS
+
+This folder contains a Terraform module for deploying Vault to AWS
+(within a VPC). It can be used as-is or can be modified to work in your
+scenario, but should serve as a strong starting point for deploying Vault.
+
+See `variables.tf` for a full reference to the parameters that this module
+takes and their descriptions.

terraform/aws/main.tf

@@ -19,6 +19,7 @@ resource "aws_autoscaling_group" "vault" {
     health_check_grace_period = 15
     health_check_type = "EC2"
     vpc_zone_identifier = ["${split(",", var.subnets)}"]
+    load_balancers = ["${aws_elb.vault.id}"]
 
     tag {
         key = "Name"
@@ -62,3 +63,63 @@ resource "aws_security_group" "vault" {
         cidr_blocks = ["0.0.0.0/0"]
     }
 }
+
+// Launch the ELB that is serving Vault. This has proper health checks
+// to only serve healthy, unsealed Vaults.
+resource "aws_elb" "vault" {
+    name = "vault"
+    availability_zones = ["${split(",", var.availability-zones)}"]
+    connection_draining = true
+    connection_draining_timeout = 400
+    internal = true
+    subnets = ["${split(",", var.subnets)}"]
+    security_groups = ["${aws_security_group.elb.id}"]
+
+    listener {
+        instance_port = 8200
+        instance_protocol = "tcp"
+        lb_port = 80
+        lb_protocol = "tcp"
+    }
+
+    listener {
+        instance_port = 8200
+        instance_protocol = "tcp"
+        lb_port = 443
+        lb_protocol = "tcp"
+    }
+
+    health_check {
+        healthy_threshold = 2
+        unhealthy_threshold = 3
+        timeout = 5
+        target = "${var.elb-health-check}"
+        interval = 15
+    }
+}
+
+resource "aws_security_group" "elb" {
+    name = "vault-elb"
+    description = "Vault ELB"
+
+    ingress {
+        from_port = 80
+        to_port = 80
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+
+    ingress {
+        from_port = 443
+        to_port = 443
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+
+    egress {
+        from_port = 0
+        to_port = 0
+        protocol = "-1"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+}

terraform/aws/variables.tf

@@ -21,7 +21,7 @@ variable "extra-install" {
 //-------------------------------------------------------------------
 
 variable "ami" {
-    default = "ami-d0c807d0"
+    default = "ami-7eb2a716"
     description = "AMI for Vault instances"
 }
 
@@ -30,6 +30,11 @@ variable "availability-zones" {
     description = "Availabilizy zones for launcing the Vault instances"
 }
 
+variable "elb-health-check" {
+    default = "HTTP:8200/v1/sys/health"
+    description = "Health check for Vault servers"
+}
+
 variable "instance_type" {
     default = "m3.medium"
     description = "Instance type for Vault instances"