terraform-registry/terraform-vault-tenant
terraform-registry/terraform-vault-tenant
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: only allow tenant admin to create tokens with its own policies
All checks were successful
development / Check commit compliance (push) Successful in 5s
Details
pull-requests-open / Check commit compliance (pull_request) Successful in 5s
Details

Browse Source
This commit is contained in:
Bertrand Lanson 2024-05-25 18:24:24 +02:00
parent 8ab67a2ed6
commit 39371c8503
Signed by: lanson
SSH Key Fingerprint: SHA256:/nqc6HGqld/PS208F6FUOvZlUzTS0rGpNNwR5O2bQBw
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
admin_approle.tf
View File

@ -22,5 +22,5 @@ resource "vault_identity_entity" "tenant_admin" {
resource "vault_policy" "tenant_admin" {
name = "${var.tenant_name}-admin"
policy = var.tenant_admin_policy_file == null ? templatefile("${path.module}/policies/tenant-admins.policy.hcl", { tenant_prefix = var.tenant_prefix }) : templatefile(var.tenant_admin_policy_file, { tenant_prefix = var.tenant_prefix })
policy = var.tenant_admin_policy_file == null ? templatefile("${path.module}/policies/tenant-admins.policy.hcl", { tenant_prefix = var.tenant_prefix, admin_policies = vault_approle_auth_backend_role.tenant_admin.token_policies }) : file(var.tenant_admin_policy_file)
}

7
policies/tenant-admins.policy.hcl
View File

@ -5,3 +5,10 @@ path "${tenant_prefix}/*" {
path "sys/mounts/${tenant_prefix}/*" {
capabilities = ["create", "update", "read", "delete", "list"]
}
path "auth/token/create" {
capabilities = ["create", "update", "delete"]
allowed_parameters = {
"policies" = [${admin_policies}, ${reverse(admin_policies)}]
}
}