Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Can't create sts aws secret roles when using arrays of types/arns despite API returning arrays #5972

Closed
jasonmcintosh opened this issue Dec 18, 2018 · 0 comments
Milestone

Comments

@jasonmcintosh
Copy link
Contributor

Trying to use terraform provider "vault generic secret" to manage STS roles in Vault. We had previously created a number of these roles. We upgraded to vault 0.11.4. After upgrading, the vault API returns slightly different json. We've updated our terraform to use that JSON and updates to existing aws secrets work. However, creating a NEW aws secret fails.
API Returns the following on a read:

{
  "credential_types": ["assumed_role"],
  "default_sts_ttl":0,
  "max_sts_ttl":0,
  "policy_arns":null,
  "policy_document":"",
  "role_arns":   ["${aws_iam_role.readonly_role.arn}"]
}

When we try to create this, we get the following:

* max_sts_ttl parameter only valid for assumed_role and federation_token credential types

We're obviously using a assumed_role credential type. What's interesting is this succeeds all day long on a previously created role.

IF we change the above to:

{
  "credential_type": "assumed_role",
  "default_sts_ttl":0,
  "max_sts_ttl":0,
  "policy_arns":null,
  "policy_document":"",
  "role_arn": "${aws_iam_role.readonly_role.arn}"
}

we can create the role, but then the API returns the array based values on every run.

Expected behavior
API should work with either array or non array types and not throw an error when an array type is passed without throwing an error.

Environment:

  • Vault Server Version (retrieve with vault status): 0.11.4
  • Vault CLI Version (retrieve with vault version): NA
  • Server Operating System/Architecture: CentOS 7
@jasonmcintosh jasonmcintosh changed the title Updated vault has issues with sts aws calls for role creation Can't create sts aws secret roles when using arrays of types/arns despite API returning arrays Dec 18, 2018
@jefferai jefferai added this to the 1.0.2 milestone Dec 18, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants