Resources and access

vault/locals.tf

@@ -3,7 +3,9 @@ locals {
 }
 
 module "config" {
-  source   = "../modules/config"
-  infra    = local.config.infra
-  services = local.config.services
+  source    = "../modules/config"
+  infra     = local.config.infra
+  buckets   = try(local.config.buckets, {})
+  databases = try(local.config.databases, {})
+  services  = try(local.config.services, {})
 }

vault/main.tf

@@ -10,14 +10,16 @@ resource "vault_policy" "service" {
   for_each = module.config.services
   name     = "service-${each.key}"
   policy = jsonencode({
-    path = {
-      "${vault_mount.secret.path}/data/${each.key}/*" = {
-        capabilities = ["read"]
-      }
-      "${module.config.vault.database_mount}/creds/${each.key}" = {
-        capabilities = ["read"]
-      }
-    }
+    path = merge(
+      {
+        "${vault_mount.secret.path}/data/${each.key}/*" = { capabilities = ["read"] }
+      },
+      {
+        for key, access in module.config.service_databases :
+        "${module.config.vault.database_mount}/creds/${key}" => { capabilities = ["read"] }
+        if access.service == each.key
+      },
+    )
   })
 }
 
@@ -58,10 +60,10 @@ resource "vault_policy" "terraform" {
       "auth/${local.ar}/role/+/role-id"   = { capabilities = ["read"] }
       "auth/${local.ar}/role/+/secret-id" = { capabilities = ["update"] }
 
-      "${local.kv}/data/+/s3"           = { capabilities = local.manage }
-      "${local.kv}/data/+/postgres"     = { capabilities = local.manage }
-      "${local.kv}/metadata/+/s3"       = { capabilities = ["read", "update", "delete"] }
-      "${local.kv}/metadata/+/postgres" = { capabilities = ["read", "update", "delete"] }
+      "${local.kv}/data/+/s3"             = { capabilities = local.manage }
+      "${local.kv}/data/+/postgres/+"     = { capabilities = local.manage }
+      "${local.kv}/metadata/+/s3"         = { capabilities = ["read", "update", "delete"] }
+      "${local.kv}/metadata/+/postgres/+" = { capabilities = ["read", "update", "delete"] }
 
       "sys/mounts/${local.db}"      = { capabilities = ["read"] }
       "sys/mounts/${local.db}/tune" = { capabilities = ["update"] }