84 lines
2.3 KiB
Terraform
84 lines
2.3 KiB
Terraform
terraform {
|
|
required_version = ">= 1.11.0"
|
|
|
|
required_providers {
|
|
vault = {
|
|
source = "hashicorp/vault"
|
|
version = "~> 5.7.0"
|
|
}
|
|
}
|
|
|
|
backend "s3" {}
|
|
}
|
|
|
|
provider "vault" {
|
|
address = var.vault_addr
|
|
skip_child_token = true
|
|
token = var.vault_token
|
|
}
|
|
|
|
moved {
|
|
from = vault_database_secret_backend_connection.platform_postgres
|
|
to = vault_database_secret_backend_connection.auth_system_postgres
|
|
}
|
|
|
|
removed {
|
|
from = vault_database_secret_backend_role.postgres_operator
|
|
|
|
lifecycle {
|
|
destroy = false
|
|
}
|
|
}
|
|
|
|
locals {
|
|
database_config_name = "auth-system-postgres-dev"
|
|
database_mount_path = "database"
|
|
migration_role_name = "auth-db-migration-dev"
|
|
|
|
creation_statements = [
|
|
<<-EOT
|
|
CREATE ROLE "{{name}}" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';
|
|
GRANT "${var.auth_db_role}" TO "{{name}}";
|
|
EOT
|
|
]
|
|
|
|
revocation_statements = [
|
|
<<-EOT
|
|
REASSIGN OWNED BY "{{name}}" TO "${var.auth_db_role}";
|
|
DROP OWNED BY "{{name}}";
|
|
REVOKE "${var.auth_db_role}" FROM "{{name}}";
|
|
DROP ROLE IF EXISTS "{{name}}";
|
|
EOT
|
|
]
|
|
}
|
|
|
|
resource "vault_database_secret_backend_connection" "auth_system_postgres" {
|
|
allowed_roles = [local.migration_role_name]
|
|
backend = local.database_mount_path
|
|
name = local.database_config_name
|
|
plugin_name = "postgresql-database-plugin"
|
|
verify_connection = true
|
|
|
|
postgresql {
|
|
connection_url = "postgresql://{{username}}:{{password}}@${var.postgres_host}:${var.postgres_port}/${var.postgres_database}?sslmode=${var.postgres_sslmode}"
|
|
password_authentication = "scram-sha-256"
|
|
password_wo = var.postgres_admin_password
|
|
password_wo_version = var.postgres_admin_password_version
|
|
username = var.postgres_admin_username
|
|
}
|
|
|
|
lifecycle {
|
|
create_before_destroy = true
|
|
}
|
|
}
|
|
|
|
resource "vault_database_secret_backend_role" "auth_db_migration" {
|
|
backend = local.database_mount_path
|
|
creation_statements = local.creation_statements
|
|
db_name = vault_database_secret_backend_connection.auth_system_postgres.name
|
|
default_ttl = var.auth_db_migration_default_ttl_seconds
|
|
max_ttl = var.auth_db_migration_max_ttl_seconds
|
|
name = local.migration_role_name
|
|
revocation_statements = local.revocation_statements
|
|
}
|