devops-adeel

Keybase proof

I hereby claim:

• I am adeelahmad84 on github.
• I am adeelahmad (https://keybase.io/adeelahmad) on keybase.
• I have a public key ASBtCsSJa2qo8UeTY4rGmIKinM2ogrOU4lWHMaAxDCsYpwo

To claim this, I am signing this object:

devops-adeel

Keybase proof

I hereby claim:

• I am devops-adeel on github.
• I am devops_adeel (https://keybase.io/devops_adeel) on keybase.
• I have a public key ASB4CR6QVZ3DpLsjF0xMnIFCm8huRq4_u9sEoEZdYY-OSgo

To claim this, I am signing this object:

devops-adeel

data "aws_iam_policy_document" "default" {
  version = "2012-10-17"

  statement {
    sid       = "AllowVaultAuth"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeInstances",

devops-adeel

variable "tfe_org" {}

data "vault_generic_secret" "default" {
  path = "secret/github_auth"
}

data "tfe_organization" "default" {
  name = var.tfe_org
}

devops-adeel

resource "vault_audit" "file" {
  type        = "file"
  description = "Vault Audit to File"

  options = {
    file_path = "/var/log/vault_audit.log"
    format    = "json"
    mode      = "0000"
    prefix    = "vault"
  }

devops-adeel

resource "vault_ldap_auth_backend" "default" {
    path        = "ldap"
    url         = "ldaps://dc-01.example.org"
    userdn      = "OU=Users,OU=Accounts,DC=example,DC=org"
    userattr    = "sAMAccountName"
    upndomain   = "EXAMPLE.ORG"
    discoverdn  = false
    groupdn     = "OU=Groups,DC=example,DC=org"
    groupfilter = "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))"
}

devops-adeel

locals {
  namespace = format(
    "{{identity.entity.aliases.%s.metadata.service_account_namespace}}",
    vault_auth_backend.default.accessor
  )
}

data "kubernetes_service_account_v1" "default" {
  metadata {
    name      = "vault-auth"

devops-adeel

locals {
  aad_group      = var.aad_group
  application    = var.application_name
  mount_accessor = var.mount_accessor
}

data "azuread_group" "default" {
  display_name = local.aad_group
}

devops-adeel

jobs:
 build:
   permissions:
     contents: read
     id-token: write
   steps:
      - name: Retrieve secret from Vault
        uses: hashicorp/vault-action@v2.4.0
        with:
          url: https://vault-cluster-private-url.aws.hashicorp.cloud:8200

devops-adeel

data "aws_kms_key" "auto_unseal" {
  key_id = "alias/my-key"
}

data "aws_iam_policy_document" "auto_unseal" {
  version = "2012-10-17"
  statement {
    effect = "Allow"
    actions = [
      "kms:DescribeKey",