通过Terraform在ECS服务中配置Vault Agent Sidecar传递Vault环境变量

一、修复当前任务定义的错误（解决ARN语法报错） #

1. 修正JSON语法错误 #

你的Datadog容器配置存在JSON语法错误，导致ECS解析失败（错误提示被误导为ARN问题）。修正后的Datadog容器配置如下：

{
    "name" : "${var.service_name}-datadog-agent",
    "image" : "public.ecr.aws/datadog/agent:latest",
    "cpu" : 100,
    "memory" : 512,
    "essential" : true,
    "portMappings" : [
        {
          "hostPort" : 8126,
          "protocol" : "tcp",
          "containerPort" : 8126
        }
    ],
    "environment" : [
        {
          "name" : "ECS_FARGATE",
          "value" : "true"
        }
    ]
},

错误点：原配置中environment数组闭合时错误使用了}，应改为]。

2. 修正环境文件配置 #

主容器的environmentFiles类型设置为s3，但值是本地路径，不符合要求。由于我们用Vault Agent生成本地环境变量文件，应将类型改为file：

"environmentFiles": [
    {
        "value": "/etc/secrets/env_vars", 
        "type" : "file" 
    }
],

3. 验证角色ARN有效性 #

确保var.ecs_task_role_arn和var.ecs_task_execution_role_arn传入的是有效AWS IAM角色ARN，格式示例：
arn:aws:iam::123456789012:role/ecs-task-role-name

4. 适配Fargate卷配置 #

Fargate中shared类型的Docker卷是临时空卷，无法预先存放配置文件。推荐将Vault Agent配置嵌入容器命令中，避免依赖外部卷：

{
    "name" : "vault-agent",
    "image" : "hashicorp/vault-agent:latest",
    "cpu" : 50,
    "memory" : 128,
    "essential" : false,
    "command" : ["sh", "-c", "cat <<EOF > /vault/config/config.hcl
pid_file = \"/tmp/vault-agent-pid\"

auto_auth {
  method \"aws\" {
    mount_path = \"auth/aws\"
    config = {
      type = \"iam\"
      role = \"${var.vault_aws_auth_role}\"
    }
  }

  sink \"file\" {
    config = {
      path = \"/vault/secrets/env_vars\"
      file_permission = \"0644\"
    }
  }
}

vault {
  address = \"${var.vault_address}\"
}

template {
  source      = \"/vault/templates/env.ctmpl\"
  destination = \"/vault/secrets/env_vars\"
  perms = \"0644\"
}
EOF && cat <<EOF > /vault/templates/env.ctmpl
{{- with secret \"secret/apps/${var.service_name}/env\" }}
DB_HOST={{ .Data.data.db_host }}
DB_PASSWORD={{ .Data.data.db_password }}
API_KEY={{ .Data.data.api_key }}
{{- end }}
EOF && vault agent -config=/vault/config/config.hcl"],
    "mountPoints" : [
        {
            "sourceVolume": "vault-secrets",
            "containerPath": "/vault/secrets"
        }
    ],
    "environment" : [
        {
            "name": "VAULT_ADDR",
            "value": "${var.vault_address}"
        }
    ],
    "healthCheck": {
        "command": ["sh", "-c", "test -f /vault/secrets/env_vars"],
        "interval": 5,
        "timeout": 2,
        "retries": 3
    }
},

5. 添加容器依赖（可选） #

让主容器等待Vault Agent完成密钥拉取，在主容器配置中添加：

"dependsOn": [
    {
        "containerName": "vault-agent",
        "condition": "HEALTHY"
    }
],

二、Vault Agent配置说明 #

1. 核心配置要点 #

• AWS Auth认证：依赖ECS任务角色的IAM权限，需在Vault侧预先配置信任该角色的AWS Auth角色。
• 模板渲染：通过template块从Vault KV引擎拉取密钥，生成符合环境变量格式的文件。
• 权限控制：设置生成文件的权限，避免主容器读取异常。

2. Vault侧前置配置 #

启用AWS Auth方法

vault auth enable aws

创建AWS Auth角色（信任ECS任务角色）

vault write auth/aws/role/${var.service_name}-role \
    auth_type=iam \
    bound_iam_principal_arns=arn:aws:iam::123456789012:role/${var.ecs_task_role_name} \
    policies=${var.service_name}-policy \
    max_ttl=1h

创建Vault访问策略

path "secret/apps/${var.service_name}/*" {
  capabilities = ["read"]
}

三、PKI证书生成扩展配置 #

当需要用Vault生成证书时，在Vault Agent命令中添加额外模板：

# 在Vault Agent的command中追加以下内容
cat <<EOF > /vault/templates/cert.ctmpl
{{- with pki_issue "pki/issue/${var.service_name}-cert-role" "common_name=${var.service_name}.example.com" "ttl=72h" }}
{{ .Data.certificate }}
{{- end }}
EOF
cat <<EOF > /vault/templates/key.ctmpl
{{- with pki_issue "pki/issue/${var.service_name}-cert-role" "common_name=${var.service_name}.example.com" "ttl=72h" }}
{{ .Data.private_key }}
{{- end }}
EOF
# 在Vault Agent的config.hcl中添加
template {
  source      = "/vault/templates/cert.ctmpl"
  destination = "/vault/secrets/tls/cert.pem"
  perms = "0644"
}
template {
  source      = "/vault/templates/key.ctmpl"
  destination = "/vault/secrets/tls/key.pem"
  perms = "0600"
}

同时在主容器中添加证书挂载点：

"mountPoints": [
    {
        "sourceVolume": "vault-secrets",
        "containerPath": "/etc/secrets"  
    },
    {
        "sourceVolume": "vault-secrets",
        "containerPath": "/etc/tls",
        "readOnly": true
    }
],

内容的提问来源于stack exchange，提问作者Stephen Johnson