Vault permissions should be more finely tuned about terraform-aws-quorum-cluster HOT 3 CLOSED

Current Policy gives everyone access everywhere. Afterwards:

• addresses, makers, validators, observers, bootnodes/addresses should be read access for all nodes. write access for the owners.
  • broadcast_role_info is where quorum writes the node address to Vault
• keys, passwords, bootnodes/keys, bootnodes/passwords are private data, only accessible by the owner. Full RWU access for owners, nothing elsewhere
• File which assigns policies: generate-setup-vault, actual line
• Right now we make one IAM role per region that has nodes. That breaks down because nodes are being identified by that IAM Role, and we need diff nodes to have diff identities. Instead create one IAM role for each node -- from AWS's view, they all act the same and should have the same policy, but we need them to be distinguishable from Vault.
• Script calling generate-setup-vault

from terraform-aws-quorum-cluster.

This is my second priority after the bootnode replacement issue, but I'll be working on it when things are building over there. Work on this issue will be going on the narrow-vault-policies branch of my fork.

from terraform-aws-quorum-cluster.

First draft of the fix on this is in!

from terraform-aws-quorum-cluster.