Terraform Aws Vault

A Terraform Module for how to run Vault on AWS using Terraform and Packer
Alternatives To Terraform Aws Vault
Project NameStarsDownloadsRepos Using ThisPackages Using ThisMost Recent CommitTotal ReleasesLatest ReleaseOpen IssuesLicenseLanguage
Packer14,4258525 hours ago350August 02, 2022375mpl-2.0Go
Packer is a tool for creating identical machine images for multiple platforms from a single source configuration.
Terratest6,875116a day ago364September 08, 2022225apache-2.0Go
Terratest is a Go library that makes it easier to write automated tests for your infrastructure code.
Amazon Eks Ami2,133
6 hours ago100mit-0Shell
Packer configuration for building a custom EKS AMI
2 years ago26gpl-3.0Python
Builds malware analysis Windows VMs so that you don't have to.
Terraform Aws Vault653
4 months ago63August 18, 202171apache-2.0HCL
A Terraform Module for how to run Vault on AWS using Terraform and Packer
Terraform Aws Consul404
4 months ago69apache-2.0HCL
A Terraform Module for how to run Consul on AWS using Terraform and Packer
Ami Builder Packer376
4 years agoapache-2.0
An example of an AMI Builder using CI/CD with AWS CodePipeline, AWS CodeBuild, Hashicorp Packer and Ansible.
Infrastructure As Code Training336
6 months ago9apache-2.0Ruby
Materials for learning how to use infrastructure-as-code
Elasticsearch Cloud Deploy321
7 months ago15apache-2.0HCL
Deploy Elasticsearch on the cloud easily
Multi Env Deploy302
7 months ago3apache-2.0HCL
Complete example of deploying complex web apps to AWS using Terraform, Ansible, and Packer
Alternatives To Terraform Aws Vault
Select To Compare

Alternative Project Comparisons


This repository is no longer supported, please consider using this repository for the latest and most supported version for Vault.

Moving forward in the future this repository will be no longer supported and eventually lead to deprecation. Please use our latest versions of our products moving forward or alternatively you may fork the repository to continue use and development for your personal/business use.

Vault AWS Module

This repo contains a set of modules in the modules folder for deploying a Vault cluster on AWS using Terraform. Vault is an open source tool for managing secrets. By default, this Module uses Consul as a storage backend. You can optionally add an S3 backend for durability.

Vault architecture

This Module includes:

How do you use this Module?

This repo has the following structure:

  • modules: This folder contains several standalone, reusable, production-grade modules that you can use to deploy Vault.
  • examples: This folder shows examples of different ways to combine the modules in the modules folder to deploy Vault.
  • test: Automated tests for the modules and examples.
  • root folder: The root folder is an example of how to use the vault-cluster module module to deploy a Vault cluster in AWS. The Terraform Registry requires the root of every repo to contain Terraform code, so we've put one of the examples there. This example is great for learning and experimenting, but for production use, please use the underlying modules in the modules folder directly.

To deploy Vault to production with this repo, you will need to deploy two separate clusters: one to run Consul servers (which Vault uses as a storage backend) and one to run Vault servers.

To deploy the Consul server cluster, use the Consul AWS Module.

To deploy the Vault cluster:

  1. Create an AMI that has Vault installed (using the install-vault module) and the Consul agent installed (using the install-consul module). Here is an example Packer template.

    If you are just experimenting with this Module, you may find it more convenient to use one of our official public AMIs. Check out the aws_ami data source usage in main.tf for how to auto-discover this AMI.

    WARNING! Do NOT use these AMIs in your production setup. In production, you should build your own AMIs in your own AWS account.

  2. Deploy that AMI across an Auto Scaling Group in a private subnet using the Terraform vault-cluster module.

  3. Execute the run-consul script with the --client flag during boot on each Instance to have the Consul agent connect to the Consul server cluster.

  4. Execute the run-vault script during boot on each Instance to create the Vault cluster.

  5. If you only need to access Vault from inside your AWS account (recommended), run the install-dnsmasq module on each server or setup-systemd-resolved (in the case of Ubuntu 18.04) and that server will be able to reach Vault using the Consul Server cluster as the DNS resolver (e.g. using an address like vault.service.consul). See the vault-cluster-private example for working sample code.

  6. If you need to access Vault from the public Internet, deploy the vault-elb module in a public subnet and have all requests to Vault go through the ELB. See the main.tf in the root folder of this repo example for working sample code.

  7. Head over to the How do you use the Vault cluster? guide to learn how to initialize, unseal, and use Vault.

What's a Module?

A Module is a canonical, reusable, best-practices definition for how to run a single piece of infrastructure, such as a database or server cluster. Each Module is created primarily using Terraform, includes automated tests, examples, and documentation, and is maintained both by the open source community and companies that provide commercial support.

Instead of having to figure out the details of how to run a piece of infrastructure from scratch, you can reuse existing code that has been proven in production. And instead of maintaining all that infrastructure code yourself, you can leverage the work of the Module community and maintainers, and pick up infrastructure improvements through a version number bump.

Who created this Module?

These modules were created by Gruntwork, in partnership with HashiCorp, in 2017 and maintained through 2021. They were deprecated in 2022 in favor of newer alternatives (see the top of the README for details).

How is this Module versioned?

This Module follows the principles of Semantic Versioning. You can find each new release, along with the changelog, in the Releases Page.

During initial development, the major version will be 0 (e.g., 0.x.y), which indicates the code does not yet have a stable API. Once we hit 1.0.0, we will make every effort to maintain a backwards compatible API and use the MAJOR, MINOR, and PATCH versions on each release to indicate any incompatibilities.


This code is released under the Apache 2.0 License. Please see LICENSE and NOTICE for more details.

Copyright © 2020 Gruntwork, Inc.

Popular Packer Projects
Popular Amazon Web Services Projects
Popular Configuration Management Categories

Get A Weekly Email With Trending Projects For These Categories
No Spam. Unsubscribe easily at any time.