Terraform Vault Provider is throwing "missing token" error even though a valid token was provided

Terraform Providers
1

Hi, I am trying to get JWT authentication in the terraform vault provider to work so i can read/write secrets from vault to use in my terraform builds.
The problem is that the provider exits with the error that no vault token was provided even though i clearly provided one as seen here:
$ terraform plan -lock=false -out=$PLAN_BUILD -var="vaulttoken=${VAULT_TOKEN}" ╷ │ Error: Error making API request. │ │ Namespace: admin │ URL: PUT [MASKED]/v1/auth/jwt/login │ Code: 400. Errors: │ │ * missing token │ │ with provider["registry.terraform.io/hashicorp/vault"], │ on providers.tf line 17, in provider "vault": │ 17: provider "vault" { │ ╵

This is the relevant terraform configuration i am using:

provider "vault" {
  address = "[MASKED]"
 
  auth_login {
    path = "auth/jwt/login"
    namespace="admin"
    method = "jwt"
    parameters = {
      role="kafka-all"
      token=var.vaulttoken
    }
  }
}

any help / suggestions are appreciated as i am stuck on this for quite some time now.

2

I think there are potentially two separate problems here.

  1. When people say “Vault token”, that usually means one of Vault’s native session tokens. If you have one of those, you’re already logged in. You don’t need to login again.

  2. If you instead what you have is a JWT from an identity provider that the auth/jwt auth method in Vault is configured to trust, then the problem is you’ve misread the specification of the login API - see https://www.vaultproject.io/api-docs/auth/jwt#jwt-login and one of your parameter names is incorrect. (jwt, not token)

2 Likes
3

Thanks for the input! It was the jwt-login part with the wrong parameter that caused the issue. It’s fixed now :slight_smile: