Secure Configuration

This topic describes how to enable Consul security features for your production workloads.

Overview

To enable security in your production workloads, you must deploy the ACL controller, which provisions tokens for other service mesh tasks. Refer to Architecture to learn more about the ACL controller.

The controller cannot provision tokens for itself, so you must create the token for the ACL controller. The following steps describe the overall process of enabling security features for your production workloads:

1. Enable the security features on your Consul server cluster per the Prerequisites.
2. Create the ACL token for the ACL controller in the datacenter.
3. Create a Secrets Manager secret containing the ACL controller’s token.
4. Create a Secrets Manager secret containing the Consul CA certificate.
5. Deploy the ACL controller
6. Deploy the other services on the mesh.

Prerequisites

Implement the following security features for your Consul server clusters before applying them to your workloads:

1. TLS encryption for RPC communication between Consul clients and servers.
2. Gossip encryption for encrypting gossip traffic.
3. Access control lists (ACLs) for authentication and authorization for Consul clients and services on the mesh.

Auth Method

Consul on ECS uses the AWS IAM Auth Method to enable tasks to automatically obtain Consul ACL tokens during startup.

With the Terraform modules for Consul on ECS, the auth method is supported by default when ACLs are enabled. The ACL controller sets up the auth method on the Consul servers. The mesh-task module configures the ECS task definition to be compatible with the auth method.

A unique task IAM role is required for each ECS task family. Task IAM roles must not be shared by different task families. This is because the task family represents only one Consul service and the task IAM role must encode the Consul service name.

By default, the mesh-task module will create and configure the task IAM role for you.

NOTE: When passing an existing IAM role to the mesh-task module using the task_role input variable, you must configure the IAM role as described in ECS Task Role Configuration to be compatible with the AWS IAM auth method.

ACL controller

1. Create a policy that grants acl:write and operator:write access for the controller. Refer to the ACL policies documentation for instructions.

2. Create a token and link it to the ACL controller policy. Refer to the ACL tokens documentation for instructions.

3. Create a Secrets Manager secret containing the ACL controller’s token and a Secrets Manager secret containing the Consul CA cert.

   resource "aws_secretsmanager_secret" "bootstrap_token" {
     name  = "bootstrap-token"
   }
   resource "aws_secretsmanager_secret_version" "bootstrap_token" {
     secret_id     = aws_secretsmanager_secret.bootstrap_token.id
     secret_string = "<bootstrap token>"
   }
   resource "aws_secretsmanager_secret" "ca_cert" {
     name  = "server-ca-cert"
   }
   resource "aws_secretsmanager_secret_version" "ca_cert" {
     secret_id     = aws_secretsmanager_secret.ca_cert.id
     secret_string = "<CA certificate for the Consul server's HTTPS endpoint>"
   }

   resource "aws_secretsmanager_secret" "bootstrap_token" {
     name  = "bootstrap-token"
   }
   resource "aws_secretsmanager_secret_version" "bootstrap_token" {
     secret_id     = aws_secretsmanager_secret.bootstrap_token.id
     secret_string = "<bootstrap token>"
   }
   resource "aws_secretsmanager_secret" "ca_cert" {
     name  = "server-ca-cert"
   }
   resource "aws_secretsmanager_secret_version" "ca_cert" {
     secret_id     = aws_secretsmanager_secret.ca_cert.id
     secret_string = "<CA certificate for the Consul server's HTTPS endpoint>"
   }

4. Use the acl-controller terraform module to deploy the controller. You must provide the ARN’s for the token and CA cert in the consul_bootstrap_token_secret_arn and consul_server_ca_cert_arn fields, respectively.

   module "acl_controller" {
     source                            = "hashicorp/consul/aws-ecs//modules/acl-controller"
     version                           = "<version>"
     consul_bootstrap_token_secret_arn = aws_secretsmanager_secret.bootstrap_token.arn
     consul_server_http_addr           = "https://consul-server.example.com:8501"
     consul_server_ca_cert_arn         = aws_secretsmanager_secret.ca_cert.arn
     ecs_cluster_arn                   = "arn:aws:ecs:us-east-1:111111111111:cluster/consul-ecs"
     region                            = "us-east-1"
     subnets                           = ["subnet-abcdef123456789"]
     name_prefix                       = "consul-ecs"
   }

   module "acl_controller" {
     source                            = "hashicorp/consul/aws-ecs//modules/acl-controller"
     version                           = "<version>"
     consul_bootstrap_token_secret_arn = aws_secretsmanager_secret.bootstrap_token.arn
     consul_server_http_addr           = "https://consul-server.example.com:8501"
     consul_server_ca_cert_arn         = aws_secretsmanager_secret.ca_cert.arn
     ecs_cluster_arn                   = "arn:aws:ecs:us-east-1:111111111111:cluster/consul-ecs"
     region                            = "us-east-1"
     subnets                           = ["subnet-abcdef123456789"]
     name_prefix                       = "consul-ecs"
   }

The following table describes the required input variables for the acl-controller module.

Enterprise

If you are using Consul Enterprise, see Admin Partitions and Namespaces for additional configuration required to support Consul Enterprise on ECS.

Deploy your services

Follow the instructions described in Create a task definition to create the basic configuration for the task module. Add the following additional configurations to make the configuration production-ready.

Create an AWS Secrets Manager secret

The secret stores the gossip encryption key that the Consul clients use.

resource "aws_secretsmanager_secret" "gossip_key" {
  name  = "gossip-encryption-key"
}
resource "aws_secretsmanager_secret_version" "gossip_key" {
  secret_id     = aws_secretsmanager_secret.gossip_key.id
  secret_string = "<Gossip encryption key>"
}

resource "aws_secretsmanager_secret" "gossip_key" {
  name  = "gossip-encryption-key"
}
resource "aws_secretsmanager_secret_version" "gossip_key" {
  secret_id     = aws_secretsmanager_secret.gossip_key.id
  secret_string = "<Gossip encryption key>"
}

Enable secure deployment

Add the following configurations to enable secure deployment. The acl_secret_name_prefix should be the same as the name_prefix you provide to the ACL controller module.

module "my_task" {
  source  = "hashicorp/consul/aws-ecs//modules/mesh-task"
  version = "<version>"
  ...
  tls                       = true
  consul_server_ca_cert_arn = aws_secretsmanager_secret.ca_cert.arn
  gossip_key_secret_arn     = aws_secretsmanager_secret.gossip_key.arn
  acls                      = true
  consul_http_addr          = "https://consul-server.example.com:8501"
  consul_https_ca_cert_arn  = aws_secretsmanager_secret.ca_cert.arn
}

module "my_task" {
  source  = "hashicorp/consul/aws-ecs//modules/mesh-task"
  version = "<version>"
  ...
  tls                       = true
  consul_server_ca_cert_arn = aws_secretsmanager_secret.ca_cert.arn
  gossip_key_secret_arn     = aws_secretsmanager_secret.gossip_key.arn
  acls                      = true
  consul_http_addr          = "https://consul-server.example.com:8501"
  consul_https_ca_cert_arn  = aws_secretsmanager_secret.ca_cert.arn
}

The following table explains the mesh-task input variables relevant to a secure configuration:

Complete the following steps described in the Installation with Terraform chapter to deploy and connect your services:

1. Run Terraform
2. Configure routes
3. Configure the bind address