terraform-registry/terraform-vault-tenant
terraform-registry/terraform-vault-tenant
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
76a0481c22
terraform-vault-tenant/README.md
Bertrand Lanson f9acfc4675
All checks were successful
pull-requests-open / Check commit compliance (pull_request) Successful in 6s
Details
development / Check commit compliance (push) Successful in 24s
Details
fix: required_parameters type in root_policy_extra_rules
2024-05-30 00:12:41 +02:00

5.7 KiB
Raw Blame History

terraform-vault-tenant

This module aims to provide a way for companies and individuals running the community version of vault, to segregate accesses between teams.

This "tenant" module requires that you have at least one approle auth method mounted prior to deploying it. It will create a tenant admin approle role on these mount, and apply the policy you define. It can also create an additional tenant-scoped approle auth mount, and create roles based on policies that you define.

The idea behind this is that outside of access control, a tenant is free to create whatever secret engine, secrets, etc... As long as those are prefixed with their tenant prefix.

Requirements

Name Version
terraform >= 1.0.0
random ~> 3.6.2
vault ~> 4.2.0

Providers

Name Version
random ~> 3.6.2
vault ~> 4.2.0

Modules

No modules.

Resources

Name Type
random_uuid.extra_secret_id resource
random_uuid.root_secret_id resource
vault_approle_auth_backend_role.extra resource
vault_approle_auth_backend_role.root resource
vault_approle_auth_backend_role_secret_id.extra resource
vault_approle_auth_backend_role_secret_id.root resource
vault_auth_backend.approle resource
vault_identity_entity.extra resource
vault_identity_entity.root resource
vault_identity_entity_alias.extra resource
vault_identity_entity_alias.root resource
vault_identity_group.this resource
vault_policy.extra resource
vault_policy.root resource
vault_policy_document.root data source

Inputs

Name Description Type Default Required
additional_roles A map of additional role names, with the path to the associated policy file to add for this tenant.
A separate approle auth method is created for this tenant (mounted at auth/-approle) including all the roles declared in this variable.
The variable should look like:
additional_roles = {
devs = file("path/to/policy.hcl")
admins = data.vault_policy_document.admins.hcl
}		 map(string) {} no
name The name of the tenant you want to create string n/a yes
prefix The prefix to use for the tenant in vault (this will prefix mount points, policies, etc..) string n/a yes
root_policy_extra_rules A map of additional policies to attach to the root policy. These are merged with the default policies for the root role so that you can customize it to your needs 
map(
    object({
      path                = string
      capabilities        = list(string)
      description         = optional(string)
      required_parameters = optional(list(string))
      allowed_parameter   = optional(map(list(any)))
      denied_parameter    = optional(map(list(any)))
      min_wrapping_ttl    = optional(number)
      max_wrapping_ttl    = optional(number)
    })
  )
 {} no

Outputs

Name Description
approle_mount The approle mount for the tenant
extra_role_policies The tenant extra role policy names
extra_roles The tenant extra approle roles
root_policy The tenant root policy name
root_role The tenant root approle role