diff --git a/deployment/aws/README.md b/deployment/aws/README.md index c63887f..b262fe7 100644 --- a/deployment/aws/README.md +++ b/deployment/aws/README.md @@ -8,6 +8,14 @@ This directory contains an AWS deployment example for Boundary using Terraform. ## Setup - Make sure you have a local checkout of `github.com/hashicorp/boundary` - Build the `boundary` binary for linux using `XC_OSARCH=linux/amd64 make dev` or download from our [release page](https://boundaryproject.io/) on our docs site. +```bash +mkdir bin +cd bin +export BOUNDARY_VERSION=0.12.0 +curl -O https://releases.hashicorp.com/boundary/$(echo $BOUNDARY_VERSION)/boundary_$(echo $BOUNDARY_VERSION)_linux_amd64.zip +unzip boundary_$(echo $BOUNDARY_VERSION)_linux_amd64.zip +rm boundary_$(echo $BOUNDARY_VERSION)_linux_amd64.zip +``` - Provide appropriate AWS credentials through the command line ## Deploy @@ -16,7 +24,7 @@ To deploy this example: 1. Clone this repo by running `git clone https://github.com/hashicorp/boundary-reference-architecture.git` 2. Navigate to `boundary-reference-architecture/deployment/aws` - If you want to change your AWS region, navigate to `aws/aws/net.tf` and change `region = ` + If you want to change your AWS region, navigate to `aws/aws/net.tf` and change `region = ` on line 6 In addition, run the command `export AWS_REGION=` to set the region in your command line 3. Run `terraform init` @@ -25,8 +33,10 @@ To deploy this example: For example: `terraform apply -target module.aws -var boundary_bin=/usr/bin` If the public SSH key you want use is not located at `~/.ssh/id_rsa.pub` then you'll also need to override that value: - ``` - terraform apply -target module.aws -var boundary_bin= -var pub_ssh_key_path= + ```bash + terraform apply -target module.aws \ + -var boundary_bin= \ + -var pub_ssh_key_path= ``` If the private key is not named the same as the public key but without the .pub suffix and/or is not stored in the same directory, you can use the `priv_ssh_key_path` variable also to point to its location; otherwise its filename will be inferred from the filename of the public key. @@ -46,7 +56,7 @@ To deploy this example: - Login on the CLI: ``` -BOUNDARY_ADDR='http://:9200' \ +BOUNDARY_ADDR='http://:9200' \ boundary authenticate password \ -login-name=jim \ -password foofoofoo \ @@ -60,7 +70,7 @@ You can also use this login name in the Boundary console that you navigated to i Connect to the target in the private subnet via Boundary: ``` -BOUNDARY_ADDR='http://:9200' \ +BOUNDARY_ADDR='http://:9200' \ boundary connect ssh --username ubuntu -target-id ttcp_ ``` diff --git a/deployment/aws/aws/cert.tf b/deployment/aws/aws/cert.tf index 1c40c66..7232d5b 100644 --- a/deployment/aws/aws/cert.tf +++ b/deployment/aws/aws/cert.tf @@ -6,7 +6,6 @@ resource "tls_private_key" "boundary" { } resource "tls_self_signed_cert" "boundary" { - key_algorithm = "RSA" private_key_pem = tls_private_key.boundary.private_key_pem subject { diff --git a/deployment/aws/aws/net.tf b/deployment/aws/aws/net.tf index 36c0b82..3430b7b 100644 --- a/deployment/aws/aws/net.tf +++ b/deployment/aws/aws/net.tf @@ -3,7 +3,7 @@ provider "aws" { version = "~> 3.0" - region = "us-east-1" + region = "eu-west-2" } data "aws_availability_zones" "available" { diff --git a/deployment/aws/boundary/main.tf b/deployment/aws/boundary/main.tf index e262a5a..5317dc3 100644 --- a/deployment/aws/boundary/main.tf +++ b/deployment/aws/boundary/main.tf @@ -5,7 +5,6 @@ terraform { required_providers { boundary = { source = "hashicorp/boundary" - version = "1.0.5" } } } diff --git a/deployment/aws/boundary/outputs.tf b/deployment/aws/boundary/outputs.tf new file mode 100644 index 0000000..6e73f17 --- /dev/null +++ b/deployment/aws/boundary/outputs.tf @@ -0,0 +1,7 @@ +output "boundary_auth_method_id" { + value = boundary_auth_method.password.id +} + +output "boundary_ssh_target_id" { + value = boundary_target.backend_servers_ssh.id +} diff --git a/deployment/aws/boundary/targets.tf b/deployment/aws/boundary/targets.tf index 9206788..d1fcac7 100644 --- a/deployment/aws/boundary/targets.tf +++ b/deployment/aws/boundary/targets.tf @@ -8,7 +8,7 @@ resource "boundary_target" "backend_servers_ssh" { scope_id = boundary_scope.core_infra.id session_connection_limit = -1 default_port = 22 - host_set_ids = [ + host_source_ids = [ boundary_host_set.backend_servers.id ] } @@ -20,7 +20,7 @@ resource "boundary_target" "backend_servers_website" { scope_id = boundary_scope.core_infra.id session_connection_limit = -1 default_port = 8000 - host_set_ids = [ + host_source_ids = [ boundary_host_set.backend_servers.id ] } diff --git a/deployment/aws/destroy-tf-run.sh b/deployment/aws/destroy-tf-run.sh new file mode 100644 index 0000000..8eae51d --- /dev/null +++ b/deployment/aws/destroy-tf-run.sh @@ -0,0 +1,2 @@ +terraform state rm module.boundary +terraform destroy diff --git a/deployment/aws/outputs.tf b/deployment/aws/outputs.tf new file mode 100644 index 0000000..1851b5b --- /dev/null +++ b/deployment/aws/outputs.tf @@ -0,0 +1,25 @@ +output "boundary_url" { + value = "http://${module.aws.boundary_lb}:9200" +} + + +output "Next_steps" { + value = <