I have a standard_customers module for onboarding customer teams into Vault. It starts from a list variable that defines each customer, and then a series of for_each resources that create the engines, policies, entities, and assigns the expected policies to the entities.
How can I best handle arbitrary exceptions for policy assignment?
Example:
I have a variable that looks like this ( but will have a lot more members in the list). The policies, notably, are calculated values based on other fields I’m not showing here; they’re not a static map I can simply edit.
"value": [
{
"app1_cms_dev": {
"app_boundary": "app1_cms_dev",
"app_name": "app1_cms",
"policies": [
"app1_cms_pki_dev_r",
"app1_cms_pki_shared_r"
],
},
"app1_cms_prod": {
"app_boundary": "app1_cms_prod",
"app_name": "app1_cms",
"policies": [
"app1_cms_pki_prod_r",
"app1_cms_pki_shared_r"
], } } ]
My resource creates roles and assigns policies:
resource "vault_aws_auth_backend_role" "aws_auth_reader" {
for_each = local.aws_auth_roles
provider = vault.admin
backend = vault_auth_backend.aws[each.value.auth_path].id
role = each.key
auth_type = "iam"
bound_iam_principal_arns = ["arn:aws:iam::${each.value.auth_id}:role/${each.value.rolename}"]
token_policies = each.value.policies[*]
}
I need to be able to override the token_policies for an arbitrary backend_role (or vault_identity_entity). If I create a static resource block, “terraform apply” will keep adding and removing/replacing the token_policies, so this clearly isn’t working as written.
resource "vault_aws_auth_backend_role" "app1_cms_dev_pki_issuer" {
provider = vault.admin
backend = "aws_auth_app1_dev"
role = "app1_cms_dev"
token_policies = ["app1_cms_pki_dev_rw"]
}
Log output from multiple runs, with “tf state show” output after each run won’t fit in this post; I will post them in comments. You can see that the same TF files (i don’t make edits between runs) keeps flip-flopping between assigned policies.
Looking at this other question from a few years ago, am I just going down the wrong path? Do I definitely need to fix up the variable being operated on by the for_each to get this to work?