Spin up Vault cluster on custom network about terraform-google-vault HOT 7 CLOSED

Hi @chanux - in general, you want to isolate Vault as much as possible from other services. This is also mentioned in the Vault hardening guide. It's not a hard requirement, but Vault should really be on its own dedicated network/IP space and traffic to that network should be restricted behind a firewall.

Let me know if you have other questions.

from terraform-google-vault.

@sethvargo I think the enterprise best practice is to use a Shared VPC so Vault can be connected over private space. It can still be restricted by firewall rules for the subnet or service account.

IMO it would make sense to allow this module to accept a custom network input.

from terraform-google-vault.

@morgante wouldn't best practice be to run a dedicated VPC and then use VPC peering instead?

from terraform-google-vault.

FWIW, I'm okay with this change, just trying to figure out what the "default" should be.

from terraform-google-vault.

@sethvargo VPC peering has a number of limitations which make it unsuitable in certain environments. I think a dedicated service account (with locked down firewall rules) in a shared VPC is an acceptable tradeoff.

from terraform-google-vault.

I think the default should be the current implementation with completely separated VPC and networks. But it would be OK if someone really really wants to be able to put all the eggs into one basket.

from terraform-google-vault.

I'll go ahead and get a PR up for this. We also need outputs of the subnet/network as well in case someone does want to put a bastion or firewall rule on that network after Vault is created.

from terraform-google-vault.