This module sets up a Vault cluster that can span 2 AWS regions. It makes use of the following AWS features:

• AWS DynamodDB global tables
• AWS SecretManager global replication
• AWS KMS cross region replicas
• Cross region VPC peering

By default resources are replicated in another region to act as a DR plan. It is possible to not run Vault instances on the other region but just keep the resources replicated.

Vault backend use DynamodDB plugins which allow HA for storage and nodes.

This module generates a pki to enable full end to end encryption into the vault instances. Certificates for vault are generated at startup on the instances and all the cluster internal communication are done with TLS

To allow end to end TLS, network load balancer are used in TCP mode. This module supports 2 NLB per region, 1 internal and 1 external.

Health Check by default are done with TCP check, this allow to use the Vault with TLS Client cert verification enabled. This also improve failover but route randomly the Vault request to any node, which then in turn forwards to the cluster leader. This generate east-west traffic across AZ and VPC Peering.

Health checks can also use HTTPS if vault client cert verification is disabled. 2 modes are availabled via the variable vault_routing_policy :

• all : HTTPS healthcheck with all node Healthy
• leader-only : HTTPS healthcehck with only leader Healthy

When vault_tls_require_and_verify_client_cert is set, health checks default to TCP.

Support for private and public hosted zone for split horizon DNS. Register automatically the NLB as alias and sets up health check for DNS failover in case an AWS region is not available.

VPC peering between the 2 provided VPC is enabled by default, if VPCs are already peered it can be disable with vpc_peering_enabled=false.

⚠️ there is a dependency issue when creating everything from scratch in the example folder. vpc_peering_enabled should be turn to true only after the VPC have been created, or use the -target feature.

Pariticule build and maintain AMI on AWS region available by default. Please pen an issue if you need us to support another region.

Instances have SSM enable by default, no need for SSH keys.

[
  "886701765425"
]

{
  "asg_associate_public_ip_address": false,
  "desired_capacity": 3,
  "disk_size": 20,
  "instance_type": "t3a.micro",
  "key_name": null,
  "max_size": 3,
  "min_size": 0,
  "tags": {},
  "tags_as_map": {},
  "vpc_zone_identifier": []
}

object({
    primary = optional(object({
      name = string
    }))
    secondary = optional(object({
      name = string
    }))
  })

{
  "internal": false,
  "ip_address_type": "dualstack",
  "listener_port": 443,
  "subnets": []
}

{
  "external": {},
  "internal": {
    "internal": true
  }
}

{
  "external": {},
  "internal": {
    "internal": true
  }
}

{
  "default": {
    "subject": {
      "common_name": "default-vault-client"
    },
    "usages": [
      "client_auth",
      "key_encipherement",
      "digital_signature"
    ]
  }
}