I need help on parameter-constraints

Vault
1

Hello all,

I created a module with the following code

data "vault_policy_document" "rule-document" {
  dynamic "rule" {
    for_each = var.token_policies
    content {
      path               = rule.value.path
      capabilities       = rule.value.vault_policy_capability
    }
  }
}

And I want to update this part of code by adding parameter-constraints as describe here.

But adding allowed_parameters, my TF plan got the following error

╷
│ Error: Unsupported argument
│
│   on .terraform/modules/github-actions-approle/main.tf line 13, in data "vault_policy_document" "rule-document":
│   13:       allowed_parameters = {
│
│ An argument named "allowed_parameters" is not expected here.

This is the following code:

data "vault_policy_document" "rule-document" {
  dynamic "rule" {
    for_each = var.token_policies
    content {
      path               = rule.value.path
      #capabilities       = rule.value.vault_policy_capability
      capabilities       = ["read", "list", "create", "delete", "update"]
      description        = "Hello World!"
      allowed_parameters = {
        "foobarz" = ["cloud-engineering"]
        "foo" = ["bar"]
      }
    }
  }
}

I really appreciate any helps on this.

Thank you,
Laurentius

2

According to the document, it should be allowed_parameter instead of allowed_parameters

3

I did try that as well, but got a different error message:

╷
│ Error: Unsupported argument
│
│   on .terraform/modules/github-actions-approle/main.tf line 20, in data "vault_policy_document" "rule-document":
│   20:       allowed_parameter  = {
│
│ An argument named "allowed_parameter" is not expected here. Did you mean to
│ define a block of type "allowed_parameter"?

TF code:

data "vault_policy_document" "rule-document" {
  dynamic "rule" {
    for_each = var.token_policies
    content {
      path               = rule.value.path
      #capabilities       = rule.value.vault_policy_capability
      capabilities       = ["read", "list", "create", "delete", "update"]
      description        = "Hello World!"
      allowed_parameter  = {
        "bar" = ["baz/*"]
      }
    }
  }
}
4

According to the doc, allowed_parameter is a [list](https://www.terraform.io/language/expressions/types#list), not a map.

5

I did try that as well, but I might miss something. Using list, I got an error

------------------------------------------------------------------------

╷
│ Error: Unsupported argument
│
│   on .terraform/modules/github-actions-approle/main.tf line 13, in data "vault_policy_document" "rule-document":
│   13:       allowed_parameter  = ["bar", "baz"]
│
│ An argument named "allowed_parameter" is not expected here. Did you mean to
│ define a block of type "allowed_parameter"?
╵

------------------------------------------------------------------------

The code is as follows:

data "vault_policy_document" "rule-document" {
  dynamic "rule" {
    for_each = var.token_policies
    content {
      path               = rule.value.path
      #capabilities       = rule.value.vault_policy_capability
      capabilities       = ["read", "list", "create", "delete", "update"]
      description        = "Hello World!"
      allowed_parameter  = ["bar", "baz"]
    }
  }
}
6

If you look at the docs: Terraform Registry

It looks to be expecting something like

allowed_parameter = [{key = "xxx", value = "xxx"}]

7

I did that before, and I just tried it as you suggested, but still got the error:

│ Error: Unsupported argument
│
│   on .terraform/modules/github-actions-approle/main.tf line 13, in data "vault_policy_document" "rule-document":
│   13:       allowed_parameter  = [{key = "secret", value = "cloud-engineering"}]
│
│ An argument named "allowed_parameter" is not expected here. Did you mean to
│ define a block of type "allowed_parameter"?

The code is as follows:

data "vault_policy_document" "rule-document" {
  dynamic "rule" {
    for_each = var.token_policies
    content {
      path               = rule.value.path
      #capabilities       = rule.value.vault_policy_capability
      capabilities       = ["read", "list", "create", "delete", "update"]
      description        = "Hello World!"
      allowed_parameter  = [{key = "secret", value = "cloud-engineering"}]
    }
  }
}
8

I think I found it. CMIIW.

data "vault_policy_document" "rule-document" {
  dynamic "rule" {
    for_each = var.token_policies
    content {
      path               = rule.value.path
      #capabilities       = rule.value.vault_policy_capability
      capabilities       = ["read", "list", "create", "delete", "update"]
      description        = "Hello World!"
      allowed_parameter {
        key = "secret"
        value = "cloud-engineering"
      }
    }
  }
}
9

Well, the value should be a [list], so it should be like this:

data "vault_policy_document" "rule-document" {
  dynamic "rule" {
    for_each = var.token_policies
    content {
      path               = rule.value.path
      #capabilities       = rule.value.vault_policy_capability
      capabilities       = ["read", "list", "create", "delete", "update"]
      description        = "Hello World!"
      allowed_parameter {
        key = "secret"
        value = [var.team_name]
      }
    }
  }
}
1 Like
10

thanks for letting us know so everyone can benifit.

1 Like