Facilitate specifying non-default VPC (shamelessly ripped off from hashicorp/terraform-aws-consul)

examples/vault-cluster-private/variables.tf

@@ -68,3 +68,4 @@ variable "vpc_id" {
   description = "The ID of the VPC to deploy into. Leave an empty string to use the Default VPC in this region."
   default     = ""
 }
+

main.tf

@@ -200,7 +200,8 @@ data "template_file" "user_data_consul" {
 # ---------------------------------------------------------------------------------------------------------------------
 
 data "aws_vpc" "default" {
-  default = "${var.use_default_vpc}"
+  default = "${var.vpc_id == "" ? true : false}"
+  id = "${var.vpc_id}"
   tags    = "${var.vpc_tags}"
 }
 

modules/vault-cluster/main.tf

@@ -212,3 +212,27 @@ data "aws_iam_policy_document" "vault_s3" {
     ]
   }
 }
+
+resource "aws_iam_role_policy" "vault_aws_EC2_IAM_Auth" {
+  count   = "${var.enable_EC2_IAM_Auth ? 1 : 0}"
+  name    = "vault_aws_EC2_IAM_Auth"
+  role    = "${aws_iam_role.instance_role.id}"
+  policy  = "${element(concat(data.aws_iam_policy_document.vault_aws_EC2_IAM_Auth.*.json, list("")), 0)}"
+}
+
+data "aws_iam_policy_document" "vault_aws_EC2_IAM_Auth" {
+  count   = "${var.enable_EC2_IAM_Auth ? 1 : 0}"
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "ec2:DescribeInstances",
+      "iam:GetInstanceProfile",
+      "iam:GetUser",
+      "iam:GetRole"
+    ]
+
+    resources = ["*"]
+  }
+}
+

modules/vault-cluster/variables.tf

@@ -175,3 +175,8 @@ variable "force_destroy_s3_bucket" {
   description = "If 'configure_s3_backend' is enabled and you set this to true, when you run terraform destroy, this tells Terraform to delete all the objects in the S3 bucket used for backend storage. You should NOT set this to true in production or you risk losing all your data! This property is only here so automated tests of this module can clean up after themselves. Only used if 'enable_s3_backend' is set to true."
   default     = false
 }
+
+variable "enable_EC2_IAM_Auth" {
+  description = "Configure IAM Instance Profile on Vault cluster members to permit the user to enable AWS Auth backend. Note that this does NOT actually enable the backend, but merely sets policys that will permit it to function as expected."
+  default     = false
+}

variables.tf

@@ -91,3 +91,24 @@ variable "consul_cluster_tag_key" {
   description = "The tag the Consul EC2 Instances will look for to automatically discover each other and form a cluster."
   default     = "consul-servers"
 }
+
+variable "force_destroy_s3_bucket" {
+  description = "If you set this to true, when you run terraform destroy, this tells Terraform to delete all the objects in the S3 bucket used for backend storage. You should NOT set this to true in production or you risk losing all your data! This property is only here so automated tests of this module can clean up after themselves."
+  default     = false
+}
+
+variable "vpc_id" {
+    description = "The ID of the VPC in which the nodes will be deployed.  Uses default VPC if not supplied."
+    default = ""
+}
+
+variable "enable_s3_backend" {
+  description = "Whether to configure an S3 storage backend in addition to Consul."
+  default     = false
+}
+
+variable "enable_EC2_IAM_Auth" {
+  description = "Configure IAM Instance Profile on Vault cluster members to permit the user to enable AWS Auth backend. Note that this does NOT actually enable the backend, but merely sets policys that will permit it to function as expected."
+  default     = false
+}
+