Will Anderson
89564ccec7
vault-kms.tf: KMS keyring/key for Vault auto-unseal + vault-unseal SA and IAM bindings — all imported from existing GCP resources. prevent_destroy=true on the crypto key to protect against accidental deletion. unmanaged-secrets.tf: 8 secrets that were referenced by live Cloud Run services but had no TF resource — anthropic-api-key, resend-api-key, supabase-service-key, docuseal-webhook-token, stripe-price-professional, stripe-price-founding, stripe-price-family-child, gitea-runner-token. service-account.tf: 4 manually-created SAs — neuron-workspace-dwd, docuseal-storage, analytics-reader, harmonic-search-console.
47 lines
1.8 KiB
Terraform
47 lines
1.8 KiB
Terraform
# ── Vault KMS Auto-Unseal ─────────────────────────────────────────────────────
|
|
# Vault running on Legion uses GCP KMS for auto-unseal. Configured in:
|
|
# servers/legion/apps/vault.yaml (seal "gcpckms" block)
|
|
# Key ring: vault, key: vault-unseal, location: global
|
|
#
|
|
# CRITICAL: prevent_destroy = true on the crypto key.
|
|
# Deleting this key makes Vault permanently sealed — all secrets inaccessible.
|
|
#
|
|
# These resources were created manually and are imported into TF state.
|
|
# Values already exist in GCP — TF is just taking ownership.
|
|
|
|
resource "google_kms_key_ring" "vault" {
|
|
name = "vault"
|
|
location = "global"
|
|
project = var.project_id
|
|
}
|
|
|
|
resource "google_kms_crypto_key" "vault_unseal" {
|
|
name = "vault-unseal"
|
|
key_ring = google_kms_key_ring.vault.id
|
|
purpose = "ENCRYPT_DECRYPT"
|
|
rotation_period = "7776000s" # 90 days
|
|
|
|
lifecycle {
|
|
prevent_destroy = true
|
|
}
|
|
}
|
|
|
|
resource "google_service_account" "vault_unseal" {
|
|
account_id = "vault-unseal"
|
|
display_name = "Vault KMS Auto-Unseal"
|
|
description = "Service account for Vault auto-unseal via GCP KMS. Used by the Vault pod on Legion."
|
|
project = var.project_id
|
|
}
|
|
|
|
resource "google_kms_crypto_key_iam_member" "vault_unseal_encrypter_decrypter" {
|
|
crypto_key_id = google_kms_crypto_key.vault_unseal.id
|
|
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
|
|
member = "serviceAccount:${google_service_account.vault_unseal.email}"
|
|
}
|
|
|
|
resource "google_kms_crypto_key_iam_member" "vault_unseal_viewer" {
|
|
crypto_key_id = google_kms_crypto_key.vault_unseal.id
|
|
role = "roles/cloudkms.viewer"
|
|
member = "serviceAccount:${google_service_account.vault_unseal.email}"
|
|
}
|