Skip to content

Add policy to allow Vault user to rotate its own creds; other small improvements #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

nphilbrook
Copy link
Contributor

@nphilbrook nphilbrook commented May 23, 2025

  1. There was an extraneous assume role permission - it's only needed in one place (either on the role, referencing the user, or the reverse, doesn't need both).
  2. Added the minimal set of permissions needed for the user to rotate its own access keys
  3. A few of the Vault resources were missing the Namespace

I tested this locally, can see the results here - https://gist.github.com/nphilbrook/92bfbf04c41f35026d8261f15700e9d5

Also actually used the HCP TF workspace to use the perms and it also worked 🎉

@nphilbrook nphilbrook marked this pull request as ready for review May 23, 2025 19:25
@nphilbrook nphilbrook requested a review from a team as a code owner May 23, 2025 19:26
@nphilbrook nphilbrook changed the title Improve the AWS vault-backed example Add policy to allow Vault user to rotate its own creds; other small improvements May 23, 2025
@nphilbrook nphilbrook changed the title Add policy to allow Vault user to rotate its own creds; other small improvements Add policy example to allow Vault user to rotate its own creds; other small improvements May 23, 2025
@nphilbrook nphilbrook changed the title Add policy example to allow Vault user to rotate its own creds; other small improvements Add policy to allow Vault user to rotate its own creds; other small improvements May 23, 2025
@@ -10,6 +10,7 @@ provider "vault" {
#
# https://registry.terraform.io/providers/hashicorp/vault/latest/docs/resources/jwt_auth_backend
resource "vault_jwt_auth_backend" "tfc_jwt" {
namespace = var.vault_namespace
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like this a lot more than pulling the namespace from the provider 👍 Thanks!

@nphilbrook nphilbrook requested a review from SwiftEngineer May 28, 2025 19:37
@nphilbrook
Copy link
Contributor Author

nphilbrook commented May 29, 2025

Thank you @SwiftEngineer , I lack merge perms on this repo so if you wouldn't mind doing the squash merge I would appreciate it!

@SwiftEngineer
Copy link
Contributor

You got it @nphilbrook 👍 Thanks for the PR!!

@SwiftEngineer SwiftEngineer merged commit 4c26b48 into hashicorp:main May 30, 2025
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants