Merge pull request #60 from repping/master

updated vault aws_health.sh script

Author: repping

iam.tf

@@ -254,39 +254,41 @@ resource "aws_iam_role_policy" "lambda" {
   role   = aws_iam_role.lambda[0].id
 }
 
+data "aws_partition" "current" {}
+
+data "aws_caller_identity" "current" {}
+
 data "aws_iam_policy_document" "lambda" {
   count  = var.vault_enable_cloudwatch ? 1 : 0
   statement {
     effect  = "Allow"
     actions = [
-      "logs:CreateLogGroup",
-      "logs:CreateLogStream",
-      "logs:PutLogEvents",
-      "logs:DescribeLogGroups"
+      "cloudwatch:PutMetricData"
     ]
     resources = [
-      # TODO should be --> Resource: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:*"
-      "*"
+    "*"
     ]
   }
   statement {
     effect  = "Allow"
     actions = [
-      "logs:PutLogEvents"
+      "logs:CreateLogGroup",
+      "logs:CreateLogStream",
+      "logs:PutLogEvents",
+      "logs:DescribeLogGroups"
     ]
     resources = [
-      # TODO should be --> Resource: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:*:log-stream:*"
-      "*"
+      "arn:${data.aws_partition.current.partition}:logs:${data.aws_region.default.name}:${data.aws_caller_identity.current.id}:log-group:*",
+      "arn:${data.aws_partition.current.partition}:logs:${data.aws_region.default.name}:${data.aws_caller_identity.current.id}:log-group:*:log-stream:*"
     ]
   }
   statement {
     effect  = "Allow"
     actions = [
-      "ec2:DescribeInstances",
-      "ec2:DescribeImages"
+      "logs:PutLogEvents"
     ]
     resources = [
-      "*"
+      "arn:${data.aws_partition.current.partition}:logs:${data.aws_region.default.name}:${data.aws_caller_identity.current.id}:log-group:*:log-stream:*",
     ]
   }
   statement {
@@ -296,7 +298,6 @@ data "aws_iam_policy_document" "lambda" {
       "ec2:DescribeImages"
     ]
     resources = [
-      # TODO should be --> Resource: !Sub "arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:instance/*"
       "*"
     ]
   }
@@ -308,8 +309,7 @@ data "aws_iam_policy_document" "lambda" {
       "cloudwatch:PutMetricAlarm"
     ]
     resources = [
-      # TODO should be --> Resource:  !Sub "arn:${AWS::Partition}:cloudwatch:${AWS::Region}:${AWS::AccountId}:alarm:AutoAlarm-*"
-      "*"
+      "arn:${data.aws_partition.current.partition}:cloudwatch:${data.aws_region.default.name}:${data.aws_caller_identity.current.id}:alarm:AutoAlarm-*"
     ]
   }
   statement {
@@ -318,7 +318,7 @@ data "aws_iam_policy_document" "lambda" {
       "cloudwatch:DescribeAlarms"
     ]
     resources = [
-      "*"
+    "*"
     ]
   }
   statement {
@@ -327,8 +327,7 @@ data "aws_iam_policy_document" "lambda" {
       "ec2:CreateTags"
     ]
     resources = [
-      # TODO should be --> Resource: !Sub "arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:instance/*"
-      "*"
+      "arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.default.name}:${data.aws_caller_identity.current.id}:instance/*"
     ]
   }
 }

user_data_vault.sh.tpl

@@ -200,26 +200,24 @@ usermod -G vault ec2-user
 
 # Place an AWS EC2 health check script.
 cat << EOF >> /usr/local/bin/aws_health.sh
-#!/bin/sh
-
-# This script checks that status of Vault and reports that status to the ASG.
-# If Vault fails, the instance is replaced.
-
-# Tell Vault how to connect.
-export VAULT_ADDR=https://$${my_ipaddress}:8200
-export VAULT_CACERT="${vault_data_path}/tls/vault_ca.crt"
-
-# Get the status of Vault and report to AWS ASG.
-# TODO: This check is not sufficient; 0 is returned in many cases.
-if vault status > /dev/null 2>&1 ; then
-  aws --region $${my_region} autoscaling set-instance-health --instance-id $${my_instance_id} --health-status Healthy
-else
-  # Randominze the moment when to set the instance to unhealthy. This helps gradually replacing unhealthy instances.
-  # For example; a cluster that is configured as a replication secondary has all followers set to unhealthy, risking
-  # loosing quorum.
-  sleep $((RANDOM % 60))
-  aws --region $${my_region} autoscaling set-instance-health --instance-id $${my_instance_id} --health-status Unhealthy
-fi
+!/bin/bash
+
+# Set variables
+VAULT_STATUS_URL="https://$${my_ipaddress}:8200/v1/sys/health"
+TIMEOUT=5
+
+# Perform the health check
+response=\$(curl -k -m \$TIMEOUT -s -o /dev/null -w "%%{http_code}" \$VAULT_STATUS_URL)
+
+# Check the response code
+case \$response in
+  200|429|472|473)
+    aws --region $${my_region} autoscaling set-instance-health --instance-id $${my_instance_id} --health-status Healthy
+  ;;
+  *)
+    aws --region $${my_region} autoscaling set-instance-health --instance-id $${my_instance_id} --health-status Unhealthy
+  ;;
+esac
 EOF
 
 # Make the AWS EC2 health check script executable.