applied suggestions from review, udpates to TF secure configuration
This commit is contained in:
trujillo-adam
parent
8dc94aff32
commit
be6fe11784
|
|
@ -22,13 +22,13 @@ The following procedure describes the general workflow:
|
|||
|
||||
2. [Run Terraform](#running-terraform) to deploy the resources in AWS
|
||||
|
||||
If you want to operate Consul with ACLs enabled (recommended), follow the instructions in the [Secure Configuration](/docs/ecs/terraform/secure-configuration) documentation. ACLs provide network security for production-grade deployments.
|
||||
If you want to operate Consul in production environments, follow the instructions in the [Secure Configuration](/docs/ecs/terraform/secure-configuration) documentation. The instructions describe how to enable ACLs and TLS and gossip encyption, which provide network security for production-grade deployments.
|
||||
|
||||
## Requirements
|
||||
|
||||
* You should have some familiarity with using Terraform. Refer to the [Terraform documentation](https://www.terraform.io/docs) to learn about infrastructure as code and how to get started with Terraform.
|
||||
* You should also be familiar with AWS ECS before following these instructions. See [What is Amazon Elastic Container Service](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/Welcome.html) for details.
|
||||
* If you intend to [use the `gateway-task` module to deploy mesh gateways](#configure-the-gateway-task-module), all Consul server and client agents in all datacenters must have TLS and gossip encryption enabled (refer to [Encryption](/docs/security/encryption) for instructions).
|
||||
* If you intend to [use the `gateway-task` module to deploy mesh gateways](#configure-the-gateway-task-module), all Consul server and client agents in all datacenters must have TLS and gossip encryption enabled. Refer to the [Secure Configuration](/docs/ecs/terraform/secure-configuration) documentation for instructions.
|
||||
|
||||
## Create the task definition
|
||||
|
||||
|
|
|
|||
|
|
@ -7,63 +7,69 @@ description: >-
|
|||
|
||||
# Secure Configuration
|
||||
|
||||
This topic describes how to enable Consul security features for your production workloads. The following overview describes the process:
|
||||
This topic describes how to enable Consul security features for your production workloads.
|
||||
|
||||
## Overview
|
||||
|
||||
To enable security in your production workloads, you must deploy the [ACL controller](https://registry.terraform.io/modules/hashicorp/consul-ecs/aws/latest/submodules/acl-controller), which provisions tokens for other service mesh tasks. Refer to [Automatic ACL Token Provisioning](/docs/ecs/architecture#automatic-acl-token-provisioning) to learn more about the ACL controller.
|
||||
|
||||
The controller cannot provision tokens for itself, so you must create the token for the ACL controller. The following steps describe the overall process of enabling security features for your production workloads:
|
||||
|
||||
1. Enable the security features on your Consul server cluster per the [Prerequisites](#prerequisites).
|
||||
1. Deploy the ACL controller.
|
||||
1. Deploy your services.
|
||||
1. Create the ACL token for the ACL controller in the datacenter.
|
||||
1. Create a Secrets Manager secret containing the ACL controller's token.
|
||||
1. Create a Secrets Manager secret containing the Consul CA certificate.
|
||||
1. Deploy the ACL controller
|
||||
1. Deploy the other services on the mesh.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Implement the following configurations before proceeding:
|
||||
Implement the following security features for your Consul server clusters before applying them to your workloads:
|
||||
|
||||
1. [TLS encryption](/docs/security/encryption#rpc-encryption-with-tls) for RPC communication between Consul clients and servers.
|
||||
1. [Gossip encryption](/docs/security/encryption#gossip-encryption) for encrypting gossip traffic.
|
||||
1. [Access control lists (ACLs)](/docs/security/acl) for authentication and authorization for Consul clients and services on the mesh.
|
||||
|
||||
## ACL controller
|
||||
|
||||
## Deploy the ACL controller
|
||||
1. Create a policy that grants `acl:write` and `operator:write` access for the controller. Refer to the [ACL policies documentation](/docs/security/acl/policies) for instructions.
|
||||
1. Create a token and link it to the ACL controller policy. Refer to the [ACL tokens documentation](/docs/security/acl/tokens) for instructions.
|
||||
1. Create a Secrets Manager secret containing the ACL controller's token and a Secrets Manager secret containing the Consul CA cert.
|
||||
|
||||
Before deploying your service, you will need to deploy the [ACL controller](https://registry.terraform.io/modules/hashicorp/consul-ecs/aws/latest/submodules/acl-controller) so that it can provision the necessary tokens
|
||||
for tasks on the service mesh. To learn more about the ACL Controller, please see [Automatic ACL Token Provisioning](/docs/ecs/architecture#automatic-acl-token-provisioning).
|
||||
```hcl
|
||||
resource "aws_secretsmanager_secret" "bootstrap_token" {
|
||||
name = "bootstrap-token"
|
||||
}
|
||||
|
||||
To deploy the controller, you will first need to store an ACL token with `acl:write` and `operator:write` privileges,
|
||||
and a CA certificate for the Consul server in AWS Secrets Manager.
|
||||
resource "aws_secretsmanager_secret_version" "bootstrap_token" {
|
||||
secret_id = aws_secretsmanager_secret.bootstrap_token.id
|
||||
secret_string = "<bootstrap token>"
|
||||
}
|
||||
|
||||
```hcl
|
||||
resource "aws_secretsmanager_secret" "bootstrap_token" {
|
||||
name = "bootstrap-token"
|
||||
}
|
||||
resource "aws_secretsmanager_secret" "ca_cert" {
|
||||
name = "server-ca-cert"
|
||||
}
|
||||
|
||||
resource "aws_secretsmanager_secret_version" "bootstrap_token" {
|
||||
secret_id = aws_secretsmanager_secret.bootstrap_token.id
|
||||
secret_string = "<bootstrap token>"
|
||||
}
|
||||
resource "aws_secretsmanager_secret_version" "ca_cert" {
|
||||
secret_id = aws_secretsmanager_secret.ca_cert.id
|
||||
secret_string = "<CA certificate for the Consul server's HTTPS endpoint>"
|
||||
}
|
||||
```
|
||||
|
||||
resource "aws_secretsmanager_secret" "ca_cert" {
|
||||
name = "server-ca-cert"
|
||||
}
|
||||
1. Use the [`acl-controller` terraform module](https://registry.terraform.io/modules/hashicorp/consul-ecs/aws/latest/submodules/acl-controller?tab=inputs) to deploy the controller. You must provide the ARN's for the token and CA cert in the `consul_bootstrap_token_secret_arn` and `consul_server_ca_cert_arn` fields, respectively.
|
||||
|
||||
resource "aws_secretsmanager_secret_version" "ca_cert" {
|
||||
secret_id = aws_secretsmanager_secret.ca_cert.id
|
||||
secret_string = "<CA certificate for the Consul server's HTTPS endpoint>"
|
||||
}
|
||||
```
|
||||
|
||||
Use the [`acl-controller` terraform module](https://registry.terraform.io/modules/hashicorp/consul-ecs/aws/latest/submodules/acl-controller?tab=inputs) to deploy the controller:
|
||||
|
||||
```hcl
|
||||
module "acl_controller" {
|
||||
source = "hashicorp/consul/aws-ecs//modules/acl-controller"
|
||||
consul_bootstrap_token_secret_arn = aws_secretsmanager_secret.bootstrap_token.arn
|
||||
consul_server_http_addr = "https://consul-server.example.com:8501"
|
||||
consul_server_ca_cert_arn = aws_secretsmanager_secret.ca_cert.arn
|
||||
ecs_cluster_arn = "arn:aws:ecs:my-region:111111111111:cluster/consul-ecs"
|
||||
region = "my-region"
|
||||
subnets = ["subnet-abcdef123456789"]
|
||||
name_prefix = "consul-ecs"
|
||||
}
|
||||
```
|
||||
```hcl
|
||||
module "acl_controller" {
|
||||
source = "hashicorp/consul/aws-ecs//modules/acl-controller"
|
||||
consul_bootstrap_token_secret_arn = aws_secretsmanager_secret.bootstrap_token.arn
|
||||
consul_server_http_addr = "https://consul-server.example.com:8501"
|
||||
consul_server_ca_cert_arn = aws_secretsmanager_secret.ca_cert.arn
|
||||
ecs_cluster_arn = "arn:aws:ecs:my-region:111111111111:cluster/consul-ecs"
|
||||
region = "my-region"
|
||||
subnets = ["subnet-abcdef123456789"]
|
||||
name_prefix = "consul-ecs"
|
||||
}
|
||||
```
|
||||
|
||||
The `name_prefix` parameter is used to prefix any secrets that the ACL controller will
|
||||
update in AWS Secrets Manager. The `name_prefix` parameter value must be unique for each ECS cluster where you deploy this controller.
|
||||
|
|
|
|||
Loading…
Reference in New Issue