This project unifies several HashiCorp & industry standard tools to address common use cases, including:
- Automated Infrastructure Deployment w/ Terraform & Jenkins Pipeline
- Dynamic Credentials via Vault
- Sentinel Policy Enforcement
- VCS Integration
- Cloud Cost Controls
We will be using Vault to not only store our sensitive credentials, but also generate short-lived credentials that serve a single purpose and expire after use. With this workflow we no longer need to hardcode credentials within our code, and can securely deploy infrastructure by 'shifting security left'.
This demo can be run in Terraform Cloud (Team & Governance, Business editions) as well as Terraform Enterprise (self-hosted).
- A TFC/E account & organization. Sign up for a free trial of TFC here
- AWS credentials to provision resources
- TFC/E API user token
- Local installation of Docker or Docker Desktop (MacOS)
- Follow & complete the configuration steps from the companion repository, then continue here
- Clone this repository locally via
git clone
- Generate a TFC/E API User Token and paste it into the
shared/vault
file- NOTE: This is for demo purposesonly--in production you'd manually add it to Vault
- Optionally change any other variables such as login username/password for Jenkins
- Vault is being run in 'dev' mode so you can simply login with the
root
token
- Vault is being run in 'dev' mode so you can simply login with the
- Launch the demo via
./start build
in the root directory of this repo- To destroy the environment, simply use
./start destroy
- To destroy the environment, simply use
After about 1-2 minutes, both Vault & Jenkins will be available for use.
- Log into Jenkins via the default credentials (unless modified):
- Username:
jenkinsuser
- Password:
changeme
- URL:
http://localhost:8080
- Username:
- Click New Item via the menu on the left
- Enter an item name, such as
Demo Pipeline
- Select Pipeline and click OK
- On the next screen, click the Pipeline tab
- Copy the contents of the Jenkins file at
jenkins/Jenkinsfile
& paste into the Script text area - Click Save
You can now click Build Now from the menu on the left. If everything was configured correctly, Jenkins should be able to process all of the stages until it gets to TF Plan & Sentinel Policy Checks, at which point it will fail due to policy failures.