Using vault rabbitmq with ssh

Question

Pulumi · Accepted Answer

In order to use Vault with RabbitMQ along with SSH, you'll typically need to do the following:

1. **Set up a Vault server** - Vault is a tool from HashiCorp for securely managing secrets. You'll need a running Vault server to handle secret management.
2. **Enable and configure the RabbitMQ secret backend on Vault** - This backend will manage RabbitMQ-specific secrets such as user credentials.
3. **Use SSH for secure communication** - You might want to secure your communication with the Vault server using SSH.

For this example, we will write a Pulumi program in TypeScript that sets up a Vault server, enables the RabbitMQ secret backend, and assumes that communication to the Vault server is over a secure network (or via an already securely established SSH tunnel). For simplicity, we will not include the actual creation of the RabbitMQ server itself, as that can be handled separately or might already exist.

We will make use of the `vault` package to configure Vault and the RabbitMQ secret backend.

Here's a Pulumi program that demonstrates how you accomplish this:

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

// Initialize a new Vault provider instance
const vaultProvider = new vault.Provider("vault-provider", {
  // Assuming the Vault server is already set up and running at this address
  address: `https://your-vault-server-address:8200`,
  // The token to authenticate against the Vault server
  token: `your-vault-authentication-token`,
});

// Enable Vault's RabbitMQ secrets engine
const rabbitMqSecretBackend = new vault.rabbitMq.SecretBackend("rabbitmq", {
  backend: "rabbitmq", // This can be customized to any path you want the secrets engine to be accessible at
}, { provider: vaultProvider });

// Configure a role that defines a set of permissions in RabbitMQ
const amqpRole = new vault.rabbitMq.SecretBackendRole("amqp-role", {
  backend: rabbitMqSecretBackend.backend,
  name: "amqp-role",
  tags: "administrator,management",
  vhosts: [{
    host: "/", // The vhost to get access to
    configure: ".*", // A RabbitMQ configure regex
    write: ".*", // A RabbitMQ write regex
    read: ".*", // A RabbitMQ read regex
  }],
}, { provider: vaultProvider });

// Output the path where the RabbitMQ secrets engine is enabled
export const rabbitMqSecretEnginePath = rabbitMqSecretBackend.backend;
```

This code sets up a Vault server with a RabbitMQ secrets engine and a role that defines what permissions that role will have in RabbitMQ. Replace `your-vault-server-address` and `your-vault-authentication-token` with your actual Vault server address and token. Likewise, if you have an existing SSH tunnel, ensure that the `address` is configured to communicate via that SSH tunnel.

Do note that this doesn't include the RabbitMQ server setup nor any SSL/SSH key setup, which will vary depending on the specifics of what you're trying to accomplish and your existing infrastructure. Often this might involve creating a RabbitMQ cluster on the desired cloud provider and establishing a means of secure communication between Vault and RabbitMQ. For SSH, if you're setting up SSH keys or using SSH tunnels, you would use additional resources or configurations not shown here like `aws.iam.SshKey` if you're using AWS.

Remember to replace placeholder values with actual configuration values suitable for your environment. Keep in mind that this program assumes that essential infrastructure components are already provisioned and securely accessible. Always protect your tokens and secrets using appropriate security measures, and consider using secrets management tools or Pulumi's secret management features for sensitive data.