George Yermulnik (Georgii Iermulnik) yermulnik

A Walk through of Key Rotation of a HashiCorp VAULT cluster using AWS KMS to AutoUnseal

PGP (Keybase) is used to encrypt the recovery keys

Built base environment using HashiCorp's Learn Website

ubuntu@ip-192-168-100-194:~$ export VAULT_ADDR=http://127.0.0.1:8200

ubuntu@ip-192-168-100-194:~$ vault status

Expanding Bash arrays safely with `set -u`

Prior to Bash 4.4 set -u treated empty arrays as "unset", and terminates the process. There are a number of possible workarounds using array parameter expansion, however almost all of them fail in certain Bash versions.

This gist is a supplement to this StackOverflow post.

Getting Started

Virtualenv setup

pip install virtualenvwrapper
mkvirtualenv tfe2tfvars
workon tfe2tfvars
pip install -r requirements.txt

I'll try to share my approach to use private GitHub hosted terraform modules with AFT v1.5.1. It relies on GH App to create ephemeral tokens during Global Customization stage which will share with the target account so it can be used during Account Customization stage.

Relates to: aws-ia/terraform-aws-control_tower_account_factory#42

Pre-requirements:

Create a GH APP:
- Permissions: allow the clone of repositories
- Set to a restricted list of terraform modules repos
Create parameter store entries for GH_APP pem, id and installation_id under AFT_MGT account

	import datetime
	import json
	import logging
	import os
	import socket
	import ssl
	from urllib2 import Request, urlopen, URLError, HTTPError

	import boto3

	# How to install:
	# pre-commit install --install-hooks && pre-commit install --install-hooks -t commit-msg

	# How temporary skip one of hooks: https://pre-commit.com/#temporarily-disabling-hooks


	repos:
	#######
	# ALL #
	#######

	#!/usr/bin/env python
	"""
	sort terraform variables
	it's easy to do, just follow these steps:
	python sort_terraform_variables.py variables.tf > sorted_variables.tf
	mv sorted_variables.tf variables.tf
	"""

	from __future__ import print_function
	import sys

	cmake_minimum_required(VERSION 3.10)
	project(cppgen VERSION 0.0.1 LANGUAGES CXX)
	set(CMAKE_CXX_STANDARD 11)
	set(CMAKE_CXX_STANDARD_REQUIRED ON)

	add_executable(remapping remapping.cc)
	target_link_libraries(remapping stdc++ "-framework Foundation" "-framework IOKit" objc)

	# * WARNING *
	# This gist is no longer maintained
	# It has been replaced by aws-assume-role-lib in PyPI
	# Documentation at https://github.com/benkehoe/aws-assume-role-lib
	# It is still a single-file library, you can find the stable version here:
	# https://raw.githubusercontent.com/benkehoe/aws-assume-role-lib/stable/aws_assume_role_lib/aws_assume_role_lib.py
	# (link also available in the docs)

	# Copyright 2020 Ben Kehoe
	#