terraform-registry/terraform-vault-tenant
terraform-registry/terraform-vault-tenant
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat/allow-extra-root-policies #3

Merged
lanson merged 10 commits from feat/allow-extra-root-policies into main 2024-05-29 22:33:04 +00:00
Conversation 0 Commits 10 Files Changed 4 +45 -7
1 changed files with 45 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 7b337f47f5 - Show all commits

52
root.tf
View File

@ -24,18 +24,56 @@ locals {
root_policy_rules = merge(local.root_policy_default_rules, var.root_policy_extra_rules)
}
# data "vault_policy_document" "root" {
# dynamic "rule" {
# for_each = local.root_policy_rules
# content {
# path = each.value.path
# capabilities = each.value.capabilities
# description = try(each.value.description, null)
# required_parameters = try(each.value.required_parameters, null)
# allowed_parameter = try(each.value.allowed_parameter, null)
# denied_parameter = try(each.value.denied_parameter, null)
# min_wrapping_ttl = try(each.value.min_wrapping_ttl, null)
# max_wrapping_ttl = try(each.value.max_wrapping_ttl, null)
# }
# }
# }
data "vault_policy_document" "root" {
dynamic "rule" {
for_each = local.root_policy_rules
content {
path = each.value.path
capabilities = each.value.capabilities
description = try(each.value.description, null)
path = rule.value.path
capabilities = rule.value.capabilities
description = try(rule.value.description, null)
min_wrapping_ttl = try(rule.value.min_wrapping_ttl, null)
max_wrapping_ttl = try(rule.value.max_wrapping_ttl, null)
required_parameters = try(each.value.required_parameters, null)
allowed_parameter = try(each.value.allowed_parameter, null)
denied_parameter = try(each.value.denied_parameter, null)
min_wrapping_ttl = try(each.value.min_wrapping_ttl, null)
max_wrapping_ttl = try(each.value.max_wrapping_ttl, null)
# dynamic "required_parameters" {
# for_each = rule.value.required_parameters != null ? rule.value.required_parameters : {}
# content {
# key = required_parameters.key
# value = required_parameters.value
# }
# }
dynamic "allowed_parameter" {
for_each = rule.value.allowed_parameter != null ? rule.value.allowed_parameter : {}
content {
key = allowed_parameter.key
value = allowed_parameter.value
}
}
dynamic "denied_parameter" {
for_each = rule.value.denied_parameter != null ? rule.value.denied_parameter : {}
content {
key = denied_parameter.key
value = denied_parameter.value
}
}
}
}
}