DOCSEARCHbyAlgolia
Submit Docs

Terraform Vault Provider

repository·main·Indexed 19 days ago

https://github.com/hashicorp/terraform-provider-vault

The Terraform Vault provider allows users to manage HashiCorp Vault resources, including secrets, policies, and other entities, using the Terraform configuration language. It provides resources and data sources for managing Vault auth methods, secrets engines, and system backend configurations.

Tokens
284.2K
Snippets
716
Records
1.2K
Agent score
66%

What's inside terraform-provider-vault

  1. Overview of the Vault Provider

    main

    The Vault provider allows Terraform to read from, write to, and configure HashiCorp Vault. It is primarily used for two distinct use cases:

    1. Configuring and Populating Vault: Vault administrators use Terraform to set up Vault itself and populate it with secrets.
    2. Using Vault credentials in Terraform configuration: Using Vault to obtain short-lived credentials (e.g., from the AWS Secrets Engine) to authenticate other Terraform providers.

    Security Warning

    Interacting with Vault from Terraform causes any secrets that you read and write to be persisted in both Terraform's state file and in any generated plan files. These files must be treated as sensitive and protected accordingly. Terraform currently has no mechanism to redact or protect secrets provided via configuration or returned via data sources.

  3. Manage Azure Key Vault providers with vault_keymgmt_azure_kms

    main

    The vault_keymgmt_azure_kms resource manages an Azure Key Vault provider within the Vault Key Management secrets engine. This allows Vault to integrate with Azure Key Vault so that keys created in Vault can be distributed to Azure Key Vault for use in Azure services. Once configured, you can use the vault_keymgmt_distribute_key resource to distribute keys.

    Note: This feature is available only with Vault Enterprise.

    Important: This resource requires Terraform 1.11+ for write-only attribute support. The credentials_wo field is write-only and will never be stored in Terraform state.

    resource "vault_keymgmt_azure_kms" "production" {
  mount          = vault_mount.keymgmt.path
  name           = "azure-production"
  key_collection = "my-keyvault"
  credentials_wo = {
    tenant_id     = var.azure_tenant_id
    client_id     = var.azure_client_id
    client_secret = var.azure_client_secret
    environment   = "AzurePublicCloud"
  }
  credentials_wo_version = 1
}

  5. Manage global group policy application mode with vault_config_group_policy_application

    main

    The vault_config_group_policy_application resource manages how policies attached to identity groups are applied across namespace boundaries in Vault Enterprise.

    Critical Constraints:

    • Singleton: Only one instance of this resource can exist per Vault cluster. Multiple resources in your configuration will cause conflicts.
    • Namespace Restriction: This resource must be managed from either the root namespace or the administrative namespace (admin).
    • Enterprise Only: This feature requires Vault Enterprise (version 1.13.8+ for the feature, though TFVP support requires 1.15.0+).
    • Deletion Behavior: Destroying this resource via Terraform does not remove the configuration from Vault; instead, it resets the mode to the default within_namespace_hierarchy.
    resource "vault_config_group_policy_application" "test" {
  group_policy_application_mode = "within_namespace_hierarchy"
}

  6. Configure the Vault AWS Auth Backend Client

    main

    The vault_aws_auth_backend_client resource configures the client used by an AWS Auth Backend in Vault. It defines the credentials (access key and secret key) or identity federation settings that Vault uses to make AWS API requests on behalf of the auth backend. It can also be used to override AWS service endpoints (EC2, IAM, STS).

    Security Warning: All data provided in the resource configuration will be written in cleartext to Terraform state and plan files and will appear in console output. Use the secret_key_wo field to mitigate state exposure.

    resource "vault_aws_auth_backend_client" "example" {
  backend                = vault_auth_backend.example.path
  access_key             = "INSERT_AWS_ACCESS_KEY"
  secret_key_wo          = var.aws_secret_key
  secret_key_wo_version  = 1
}

  7. Manage Vault AWS auth backend roles

    main

    The vault_aws_auth_backend_role resource manages roles within a Vault AWS authentication backend. These roles define constraints on the AWS principals (such as IAM roles or EC2 instances) that are permitted to perform login operations.

    To use this resource, you must first have an AWS auth backend mounted (e.g., via vault_auth_backend).

    resource "vault_auth_backend" "aws" {
  type = "aws"
}

resource "vault_aws_auth_backend_role" "example" {
  backend                         = vault_auth_backend.aws.path
  role                            = "test-role"
  auth_type                       = "iam"
  bound_ami_ids                   = ["ami-8c1be5f6"]
  bound_account_ids               = ["123456789012"]
  bound_vpc_ids                   = ["vpc-b61106d4"]
  bound_subnet_ids                = ["vpc-133128f1"]
  bound_iam_role_arns             = ["arn:aws:iam::123456789012:role/MyRole"]
  bound_iam_instance_profile_arns = ["arn:aws:iam::123456789012:instance-profile/MyProfile"]
  inferred_entity_type            = "ec2_instance"
  inferred_aws_region             = "us-east-1"
  token_ttl                       = 60
  token_max_ttl                   = 120
  token_policies                  = ["default", "dev", "prod"]
}

  8. Manage Vault UI custom messages with vault_config_ui_custom_message

    main

    The vault_config_ui_custom_message resource allows you to manage custom messages displayed in the Vault UI. These messages can appear on the login page or immediately after a user successfully logs in.

    Note: This feature is only available with Vault Enterprise.

    resource "vault_config_ui_custom_message" "maintenance" {
  title          = "Upcoming maintenance"
  message_base64 = base64encode("Vault will be offline for planned maintenance on February 1st, 2024 from 05:00Z to 08:00Z")
  type           = "banner"
  authenticated  = true
  start_time     = "2024-01-01T00:00:00.000Z"
  end_time       = "2024-02-01T05:00:00.000Z"
}

  9. Manage external plugins with vault_plugin

    main

    The vault_plugin resource allows you to manage external plugins registered in the Vault plugin catalog.

    Security Warning: All data provided in the resource configuration is written in cleartext to Terraform state and plan files and will appear in console output. Ensure you protect these artifacts.

    There are two primary ways to register plugins depending on whether they are Official Enterprise plugins or Community Edition (CE) plugins.

    resource "vault_plugin" "example" {
  type    = "auth"
  name    = "example-plugin"
  version = "v1.0.0"
}

  11. Manage KMIP Secret listeners with vault_kmip_secret_listener

    main

    The vault_kmip_secret_listener resource manages KMIP (Key Management Interoperability Protocol) Secret listeners in a Vault server. Listeners define the network configuration for KMIP servers, including the listening address, TLS settings, and the Certificate Authorities (CAs) used for generating server certificates and verifying client certificates.

    Note: This feature requires Vault Enterprise.

    resource "vault_kmip_secret_listener" "example" {
  path             = "kmip"
  name             = "example-listener"
  ca               = "example-ca"
  address          = "0.0.0.0:5696"
  server_hostnames = ["kmip.example.com"]
}