officialjaware / demo-jenkins-tfe-sentinel-vaultdev

Terraform Cloud/Enterprise + Sentinel + Jenkins + Vault Demo

This project unifies several HashiCorp & industry standard tools to address common use cases, including:

• Automated Infrastructure Deployment w/ Terraform & Jenkins Pipeline
• Dynamic Credentials via Vault
• Sentinel Policy Enforcement
• VCS Integration
• Cloud Cost Controls

We will be using Vault to not only store our sensitive credentials, but also generate short-lived credentials that serve a single purpose and expire after use. With this workflow we no longer need to hardcode credentials within our code, and can securely deploy infrastructure by 'shifting security left'.

This demo can be run in Terraform Cloud (Team & Governance, Business editions) as well as Terraform Enterprise (self-hosted).

Requirements

• A TFC/E account & organization. Sign up for a free trial of TFC here
• AWS credentials to provision resources
• TFC/E API user token
• Local installation of Docker or Docker Desktop (MacOS)

Configuration

1. Follow & complete the configuration steps from the companion repository, then continue here
2. Clone this repository locally via git clone
3. Generate a TFC/E API User Token and paste it into the shared/vault file
   • NOTE: This is for demo purposesonly--in production you'd manually add it to Vault
4. Optionally change any other variables such as login username/password for Jenkins
   • Vault is being run in 'dev' mode so you can simply login with the root token
5. Launch the demo via ./start build in the root directory of this repo
   • To destroy the environment, simply use ./start destroy

Configure Jenkins Pipeline

After about 1-2 minutes, both Vault & Jenkins will be available for use.

1. Log into Jenkins via the default credentials (unless modified):
   • Username: jenkinsuser
   • Password: changeme
   • URL: http://localhost:8080
2. Click New Item via the menu on the left
3. Enter an item name, such as Demo Pipeline
4. Select Pipeline and click OK
5. On the next screen, click the Pipeline tab
6. Copy the contents of the Jenkins file at jenkins/Jenkinsfile & paste into the Script text area
7. Click Save

You can now click Build Now from the menu on the left. If everything was configured correctly, Jenkins should be able to process all of the stages until it gets to TF Plan & Sentinel Policy Checks, at which point it will fail due to policy failures.