Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add password_policy to vault_database_secret_backend_connection #2244

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

add password_policy to vault_database_secret_backend_connection #2244

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1de7c2f
add password_policy to vault_database_secret_backend_connection
joshRooz May 20, 2024
9befb38
set computed
joshRooz Jul 24, 2024
836a8a8
update CHANGELOG.md
joshRooz Jul 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ FEATURES:
* Add support for `max_retries` in `vault_aws_auth_backend_client`: ([#2270](https://github.com/hashicorp/terraform-provider-vault/pull/2270))
* Add new resources `vault_plugin` and `vault_plugin_pinned_version`: ([#2159](https://github.com/hashicorp/terraform-provider-vault/pull/2159))
* Add `key_type` and `key_bits` to `vault_ssh_secret_backend_ca`: ([#1454](https://github.com/hashicorp/terraform-provider-vault/pull/1454))
* Add support for `password_policy` in `vault_database_secret_backend_connection` ([#2244](https://github.com/hashicorp/terraform-provider-vault/pull/2244)).

IMPROVEMENTS:
* return a useful error when delete fails for the `vault_jwt_auth_backend_role` resource: ([#2232](https://github.com/hashicorp/terraform-provider-vault/pull/2232))
Expand Down
5 changes: 5 additions & 0 deletions vault/resource_database_secret_backend_connection.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1749,6 +1749,10 @@ func writeDatabaseSecretConfig(d *schema.ResourceData, client *api.Client,
data["root_rotation_statements"] = v
}

if v, ok := d.GetOk("password_policy"); ok {
data["password_policy"] = v
}

if m, ok := d.GetOkExists(prefix + "data"); ok {
for k, v := range m.(map[string]interface{}) {
// Vault does not return the password in the API. If the root credentials have been rotated, sending
Expand Down Expand Up @@ -1885,6 +1889,7 @@ func getDBCommonConfig(d *schema.ResourceData, resp *api.Secret,
"data": d.Get(prefix + "data"),
"verify_connection": d.Get(prefix + "verify_connection"),
"plugin_name": resp.Data["plugin_name"],
"password_policy": resp.Data["password_policy"],
}

//"root_rotation_statements": resp.Data["root_credentials_rotate_statements"],
Expand Down
13 changes: 13 additions & 0 deletions vault/resource_database_secret_backend_connection_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@ func TestAccDatabaseSecretBackendConnection_postgresql_import(t *testing.T) {
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "allowed_roles.1", "prod"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "root_rotation_statements.#", "1"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "root_rotation_statements.0", "FOOBAR"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "password_policy", "foo-pol"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "verify_connection", "true"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "postgresql.0.connection_url", connURL),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "postgresql.0.max_open_connections", "2"),
Expand Down Expand Up @@ -505,6 +506,7 @@ func TestAccDatabaseSecretBackendConnection_mysql(t *testing.T) {
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "allowed_roles.1", "prod"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "root_rotation_statements.#", "1"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "root_rotation_statements.0", "FOOBAR"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "password_policy", "foo-pol"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "verify_connection", "true"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "mysql.0.connection_url", connURL),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "mysql.0.username", username),
Expand All @@ -521,6 +523,7 @@ func TestAccDatabaseSecretBackendConnection_mysql(t *testing.T) {
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "allowed_roles.1", "prod"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "root_rotation_statements.#", "1"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "root_rotation_statements.0", "FOOBAR"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "password_policy", "foo-pol"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "verify_connection", "true"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "mysql_rds.0.connection_url", connURL),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "mysql_rds.0.username", username),
Expand All @@ -537,6 +540,7 @@ func TestAccDatabaseSecretBackendConnection_mysql(t *testing.T) {
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "allowed_roles.1", "prod"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "root_rotation_statements.#", "1"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "root_rotation_statements.0", "FOOBAR"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "password_policy", "foo-pol"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "verify_connection", "true"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "mysql_aurora.0.connection_url", connURL),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "mysql_aurora.0.username", username),
Expand All @@ -553,6 +557,7 @@ func TestAccDatabaseSecretBackendConnection_mysql(t *testing.T) {
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "allowed_roles.1", "prod"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "root_rotation_statements.#", "1"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "root_rotation_statements.0", "FOOBAR"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "password_policy", "foo-pol"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "verify_connection", "true"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "mysql_legacy.0.connection_url", connURL),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "mysql_legacy.0.username", username),
Expand Down Expand Up @@ -808,6 +813,7 @@ func TestAccDatabaseSecretBackendConnection_postgresql(t *testing.T) {
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "allowed_roles.1", "prod"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "root_rotation_statements.#", "1"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "root_rotation_statements.0", "FOOBAR"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "password_policy", "foo-pol"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "verify_connection", "true"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "postgresql.0.connection_url", connURL),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "postgresql.0.max_open_connections", maxOpenConnections),
Expand Down Expand Up @@ -1252,6 +1258,7 @@ resource "vault_database_secret_backend_connection" "test" {
name = "%s"
allowed_roles = ["dev", "prod"]
root_rotation_statements = ["FOOBAR"]
password_policy = "foo-pol"

postgresql {
connection_url = "%s"
Expand Down Expand Up @@ -1462,6 +1469,7 @@ resource "vault_database_secret_backend_connection" "test" {
name = "%s"
allowed_roles = ["dev", "prod"]
root_rotation_statements = ["FOOBAR"]
password_policy = "foo-pol"

mysql {
connection_url = "%s"
Expand Down Expand Up @@ -1593,6 +1601,7 @@ resource "vault_database_secret_backend_connection" "test" {
name = "%s"
allowed_roles = ["dev", "prod"]
root_rotation_statements = ["FOOBAR"]
password_policy = "foo-pol"

mysql_rds {
connection_url = "%s"
Expand All @@ -1615,6 +1624,7 @@ resource "vault_database_secret_backend_connection" "test" {
name = "%s"
allowed_roles = ["dev", "prod"]
root_rotation_statements = ["FOOBAR"]
password_policy = "foo-pol"

mysql_aurora {
connection_url = "%s"
Expand All @@ -1637,6 +1647,7 @@ resource "vault_database_secret_backend_connection" "test" {
name = "%s"
allowed_roles = ["dev", "prod"]
root_rotation_statements = ["FOOBAR"]
password_policy = "foo-pol"

mysql_legacy {
connection_url = "%s"
Expand Down Expand Up @@ -1681,6 +1692,7 @@ resource "vault_database_secret_backend_connection" "test" {
name = "%s"
allowed_roles = ["dev", "prod"]
root_rotation_statements = ["FOOBAR"]
password_policy = "foo-pol"

postgresql {
connection_url = "%s"
Expand Down Expand Up @@ -1708,6 +1720,7 @@ resource "vault_database_secret_backend_connection" "test" {
name = "%s"
allowed_roles = ["dev", "prod"]
root_rotation_statements = ["FOOBAR"]
password_policy = "foo-pol"

postgresql {
connection_url = "%s"
Expand Down
6 changes: 6 additions & 0 deletions vault/resource_database_secrets_mount.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,12 @@ func getCommonDatabaseSchema() schemaMap {
Type: schema.TypeString,
},
},
"password_policy": {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should set Computed: True since this returns a default if not set. That will allow TFVP to fallback to the value returned by Vault.

https://developer.hashicorp.com/vault/api-docs/secret/databases#password_policy

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for having a preliminary look @fairclothjm. Much appreciated!

I have a limited familiarity with Vault's source code, but it seems that the default password policy is never externally exposed. From a client's perspective, the default password policy is an empty string. Does that align with your reasoning for setting Computed: true?

Enabling the computed behavior resolves the drift initially observed, but the attribute will quietly remain at the previously applied value. I believe such a scenario (set and applied -> removed from configuration) would be rare, but in my opinion, it makes for an obscure UX.

Type: schema.TypeString,
Optional: true,
Computed: true,
Description: "The name of the password policy to use when generating passwords for this database.",
},
"data": {
Type: schema.TypeMap,
Optional: true,
Expand Down
2 changes: 2 additions & 0 deletions website/docs/r/database_secret_backend_connection.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,8 @@ The following arguments are supported:

* `root_rotation_statements` - (Optional) A list of database statements to be executed to rotate the root user's credentials.

* `password_policy` - (Optional) The name of the password policy to use when generating passwords for this database.

* `data` - (Optional) A map of sensitive data to pass to the endpoint. Useful for templated connection strings.

* `cassandra` - (Optional) A nested block containing configuration options for Cassandra connections.
Expand Down