Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

aws_secret_backend: allow role_arns with policy_arns #710

Merged
merged 1 commit into from
Mar 31, 2020
Merged

aws_secret_backend: allow role_arns with policy_arns #710

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions vault/resource_aws_secret_backend_role.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ func awsSecretBackendRoleResource() *schema.Resource {
"policy_arns": {
Type: schema.TypeSet,
Optional: true,
ConflictsWith: []string{"policy", "policy_arn", "role_arns"},
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi! I'd be fine with pulling role_arns out here. However, I'm not so sure we should pull out the rest. Adding these deprecated parameters to ConflictsWith here is a normal part of the best practices around deprecation located here.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi!

That does seem reasonable as we're still not at the next major version bump.

ConflictsWith: []string{"policy", "policy_arn"},
Description: "ARN for an existing IAM policy the role should use.",
Elem: &schema.Schema{
Type: schema.TypeString,
Expand Down Expand Up @@ -78,7 +78,7 @@ func awsSecretBackendRoleResource() *schema.Resource {
},
Optional: true,
ForceNew: true,
ConflictsWith: []string{"policy", "policy_arn", "policy_arns"},
ConflictsWith: []string{"policy", "policy_arn"},
Description: "ARNs of AWS roles allowed to be assumed. Only valid when credential_type is 'assumed_role'",
},
"default_sts_ttl": {
Expand Down
26 changes: 17 additions & 9 deletions website/docs/r/aws_secret_backend_role.html.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ resource "vault_aws_secret_backend" "aws" {
resource "vault_aws_secret_backend_role" "role" {
backend = "${vault_aws_secret_backend.aws.path}"
name = "deploy"
credential_type = "assumed_role"
credential_type = "iam_user"

policy_document = <<EOT
{
Expand All @@ -56,19 +56,27 @@ with no leading or trailing `/`s.
* `name` - (Required) The name to identify this role within the backend.
Must be unique within the backend.

* `policy_document` - (Optional) The JSON-formatted policy to associate with this
role. Either `policy_document` or `policy_arns` must be specified.

* `policy_arns` - (Optional) The ARN for a pre-existing policy to associate
with this role. Either `policy_document` or `policy_arns` must be specified.
* `credential_type` - (Required) Specifies the type of credential to be used when
retrieving credentials from the role. Must be one of `iam_user`, `assumed_role`, or
`federation_token`.

* `role_arns` - (Optional) Specifies the ARNs of the AWS roles this Vault role
is allowed to assume. Required when `credential_type` is `assumed_role` and
prohibited otherwise.

* `credential_type` - (Required) Specifies the type of credential to be used when
retrieving credentials from the role. Must be one of `iam_user`, `assumed_role`, or
`federation_token`.
* `policy_arns` - (Optional) Specifies a list of AWS managed policy ARNs. The
behavior depends on the credential type. With `iam_user`, the policies will be
attached to IAM users when they are requested. With `assumed_role` and
`federation_token`, the policy ARNs will act as a filter on what the credentials
can do, similar to `policy_document`. When `credential_type` is `iam_user` or
`federation_token`, at least one of `policy_document` or `policy_arns` must
be specified.

* `policy_document` - (Optional) The IAM policy document for the role. The
behavior depends on the credential type. With `iam_user`, the policy document
will be attached to the IAM user generated and augment the permissions the IAM
user has. With `assumed_role` and `federation_token`, the policy document will
act as a filter on what the credentials can do, similar to `policy_arns`.

* `default_sts_ttl` - (Optional) The default TTL in seconds for STS credentials.
When a TTL is not specified when STS credentials are requested,
Expand Down