Initial commit

vault/main.tf

@@ -0,0 +1,75 @@
+resource "vault_mount" "secret" {
+  path = module.config.vault.mount
+  type = "kv"
+  options = {
+    version = "2"
+  }
+}
+
+resource "vault_policy" "service" {
+  for_each = module.config.services
+  name     = "service-${each.key}"
+  policy = jsonencode({
+    path = {
+      "${vault_mount.secret.path}/data/${each.key}/*" = {
+        capabilities = ["read"]
+      }
+      "${module.config.vault.database_mount}/creds/${each.key}" = {
+        capabilities = ["read"]
+      }
+    }
+  })
+}
+
+resource "vault_auth_backend" "approle" {
+  type = "approle"
+}
+
+resource "vault_approle_auth_backend_role" "service" {
+  for_each       = module.config.services
+  backend        = vault_auth_backend.approle.path
+  role_name      = each.key
+  token_policies = [vault_policy.service[each.key].name]
+  token_ttl      = 3600
+  token_max_ttl  = 14400
+  secret_id_ttl  = 2592000
+}
+
+locals {
+  kv = vault_mount.secret.path
+  db = module.config.vault.database_mount
+  ar = vault_auth_backend.approle.path
+
+  manage = ["create", "read", "update", "delete"]
+}
+
+resource "vault_policy" "terraform" {
+  name = "terraform"
+  policy = jsonencode({
+    path = {
+      "auth/token/create" = { capabilities = ["update"] }
+
+      "sys/mounts/${local.kv}"            = { capabilities = ["read"] }
+      "sys/mounts/auth/${local.ar}"       = { capabilities = ["read"] }
+      "sys/mounts/auth/${local.ar}/tune"  = { capabilities = ["read"] }
+      "sys/policies/acl/service-*"        = { capabilities = local.manage }
+      "sys/policies/acl/terraform"        = { capabilities = ["read", "update"] }
+      "auth/${local.ar}/role/+"           = { capabilities = local.manage }
+      "auth/${local.ar}/role/+/role-id"   = { capabilities = ["read"] }
+      "auth/${local.ar}/role/+/secret-id" = { capabilities = ["update"] }
+
+      "${local.kv}/data/+/s3"           = { capabilities = local.manage }
+      "${local.kv}/data/+/postgres"     = { capabilities = local.manage }
+      "${local.kv}/metadata/+/s3"       = { capabilities = ["read", "update", "delete"] }
+      "${local.kv}/metadata/+/postgres" = { capabilities = ["read", "update", "delete"] }
+
+      "sys/mounts/${local.db}"      = { capabilities = ["read"] }
+      "sys/mounts/${local.db}/tune" = { capabilities = ["update"] }
+      "${local.db}/config"          = { capabilities = ["list"] }
+      "${local.db}/config/postgres" = { capabilities = ["read", "update"] }
+      "${local.db}/roles/+"         = { capabilities = local.manage }
+
+      "sys/storage/raft/snapshot" = { capabilities = ["read"] }
+    }
+  })
+}