Add user_path and permissions_boundary_arn arguments to aws_secret_backend_role #781

bakeemawaytoys · 2020-05-27T22:16:55Z

I modified the aws_secret_backend_role resource to accept the user_path and permissions_boundary_arn arguments. I updated the resource's tests to account for the new arguments and consolidated some duplicate code in the tests into functions. I also removed the tests' dependency on AWS credentials because Vault doesn't interact with AWS during CRUD operations on the backend role. It will now be easier to run the tests on the aws_secret_backend_role resource.

Community Note

Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Closes #716, #769

Release note for CHANGELOG:

Add `user_path` and `permissions_boundary_arn` fields to `aws_secret_backend_role`.

Output from acceptance testing:

$ make testacc TESTARGS='-run=TestAccAWSSecretBackendRole'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test $(go list ./... |grep -v 'vendor') -v -run=TestAccAWSSecretBackendRole -timeout 120m
?       github.com/terraform-providers/terraform-provider-vault [no test files]
?       github.com/terraform-providers/terraform-provider-vault/cmd/coverage    [no test files]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/util    0.023s [no tests to run]
=== RUN   TestAccAWSSecretBackendRole_basic
--- PASS: TestAccAWSSecretBackendRole_basic (0.27s)
=== RUN   TestAccAWSSecretBackendRole_import
--- PASS: TestAccAWSSecretBackendRole_import (0.23s)
=== RUN   TestAccAWSSecretBackendRole_nested
--- PASS: TestAccAWSSecretBackendRole_nested (0.25s)
PASS
ok      github.com/terraform-providers/terraform-provider-vault/vault   0.772s
...

gfalqui · 2020-07-10T10:27:35Z

Please merge this! I'd love to have this too!

gfalqui · 2020-07-10T14:09:09Z

resource "vault_aws_secret_backend_role" "readonly" {
  backend         = vault_aws_secret_backend.aws.path
  name            = "readonly"
  credential_type = "iam_user"

  policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess"
  ]

  provisioner "local-exec" {
    command = "vault write -address=${var.vault_endpoint} -namespace=${var.vault_namespace} ${vault_aws_secret_backend.aws.path}/roles/readonly user_path=\"/vault-users/${local.vault_namespace_with_dashes}/\" permissions_boundary_arn=\"arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/policy-boundaries-name\""
  }
}

Using a provisioner can be a workaround!

Just make sure the environment contains Vault in the $PATH that has got a version that supports the new parameters.

cyriptix · 2020-07-16T10:32:48Z

Using a provisioner can be a workaround!

Worked a treat, thank you! 👍

billyaustin84 · 2020-11-10T19:47:24Z

Is this likely to make it to the top of the pile for merging?

hashicorp-cla · 2020-11-25T00:03:36Z

All committers have signed the CLA.

bakeemawaytoys · 2020-11-25T22:33:40Z

I think I was supposed to sign the CLA when I first submitted this PR but failed to do so. A helpful bot has alerted me to the situation. I've signed it and rebased to address the conflicts. Sorry about the delay on my end.

billyaustin84 · 2021-04-30T16:38:09Z

Could I ask again when this is likely to be reviewed and merged?

billyaustin84 · 2021-10-08T10:53:52Z

@jasonodonnell This PR seems to have been forgotten. Is there anything I can do to help get it back on track?

benashz · 2022-02-10T22:26:55Z

Hi @bakeemawaytoys ,

We'd like to take another look at this PR. If you still have interest, would you mind rebasing it off of main. If not we would be happy to take it over.

Thanks,

Ben

bakeemawaytoys · 2022-02-10T22:36:55Z

Sure thing. I should have some time to rebase it this weekend.

… and permissions_boundary_arn arguments. Updated the resource's tests to account for the new arguments. Consolidated some duplicate code in the tests into functions. Removed the tests' dependency on AWS credentials because Vault doesn't interact with AWS during CRUD operations on a backend role. It will now be easier to run the tests on the aws_secret_backend_role resource. Split two large multiline strings into smaller strings to make it easier modify them. (hashicorp#781)

bakeemawaytoys · 2022-02-12T19:27:33Z

Some of my changes to the test file made for a tricky rebase, but I think it is all set.

benashz · 2022-02-14T15:21:18Z

@bakeemawaytoys thanks!

benashz · 2022-04-29T22:49:52Z

Hi @bakeemawaytoys, it looks like this PR has broken some of the acceptance tests (see below for an example). Please let us know if you need an assist here.

Thanks,

Ben

=== RUN   TestAccAWSSecretBackendRole_nested
    resource_aws_secret_backend_role_test.go:100: Step 1/2 error: Error running pre-apply refresh: exit status 1
        
        Error: Missing item separator
        
          on terraform_plugin_test.tf line 19, in resource "vault_aws_secret_backend_role" "test_policy_arns":
          19:   policy_arns = ["{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": "iam:*","Resource": "*"}]}"]
        
        Expected a comma to mark the beginning of the next item.
    testing_new.go:63: Error retrieving state, there may be dangling resources: exit status 1
        
        Error: Missing item separator
        
          on terraform_plugin_test.tf line 19, in resource "vault_aws_secret_backend_role" "test_policy_arns":
          19:   policy_arns = ["{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": "iam:*","Resource": "*"}]}"]
        
        Expected a comma to mark the beginning of the next item.
        
--- FAIL: TestAccAWSSecretBackendRole_nested (0.66s)

… and permissions_boundary_arn arguments. Updated the resource's tests to account for the new arguments. Consolidated some duplicate code in the tests into functions. Removed the tests' dependency on AWS credentials because Vault doesn't interact with AWS during CRUD operations on a backend role. It will now be easier to run the tests on the aws_secret_backend_role resource. Split two large multiline strings into smaller strings to make it easier modify them. (hashicorp#781)

bakeemawaytoys · 2022-04-30T16:52:05Z

@benashz I fixed the failing tests and a few others that revealed themselves after I fixed the initial issue. Sorry for not catching that myself.

benashz

Looks good. I only have a few comments/suggestions that need to be addressed before approval.

website/docs/r/aws_secret_backend_role.html.md

vault/resource_aws_secret_backend_role.go

… and permissions_boundary_arn arguments. Updated the resource's tests to account for the new arguments. Consolidated some duplicate code in the tests into functions. Removed the tests' dependency on AWS credentials because Vault doesn't interact with AWS during CRUD operations on a backend role. It will now be easier to run the tests on the aws_secret_backend_role resource. Split two large multiline strings into smaller strings to make it easier modify them. (hashicorp#781)

benashz

LGTM!

Thanks again for your contribution to HashiCorp!

…secret_backend_role (hashicorp#781)

ghost added size/L documentation labels May 27, 2020

bakeemawaytoys force-pushed the add_missing_fields_to_aws_secret_backend_role branch from 824ac62 to f73a785 Compare November 25, 2020 22:13

jasonodonnell self-requested a review December 11, 2020 15:44

bakeemawaytoys force-pushed the add_missing_fields_to_aws_secret_backend_role branch from f73a785 to 4e25264 Compare October 20, 2021 18:31

benashz removed the request for review from jasonodonnell February 10, 2022 22:22

benashz added this to the 3.4.0 milestone Feb 10, 2022

benashz self-requested a review February 10, 2022 22:25

bakeemawaytoys force-pushed the add_missing_fields_to_aws_secret_backend_role branch from 4e25264 to 7aa86f3 Compare February 12, 2022 17:30

github-actions bot added size/XL and removed size/L labels Feb 12, 2022

bakeemawaytoys force-pushed the add_missing_fields_to_aws_secret_backend_role branch from 7aa86f3 to 357e5d6 Compare February 12, 2022 19:23

benashz modified the milestones: 3.4.0, 3.5.0 Mar 15, 2022

benashz modified the milestones: 3.5.0, 3.6.0 Apr 20, 2022

bakeemawaytoys force-pushed the add_missing_fields_to_aws_secret_backend_role branch from 357e5d6 to 1445718 Compare April 30, 2022 15:16

bakeemawaytoys force-pushed the add_missing_fields_to_aws_secret_backend_role branch from 1445718 to 00660c0 Compare April 30, 2022 16:44

benashz reviewed May 2, 2022

View reviewed changes

bakeemawaytoys force-pushed the add_missing_fields_to_aws_secret_backend_role branch from 00660c0 to d5ab5fd Compare May 2, 2022 23:21

bakeemawaytoys force-pushed the add_missing_fields_to_aws_secret_backend_role branch from d5ab5fd to 796db2a Compare May 3, 2022 00:16

bakeemawaytoys force-pushed the add_missing_fields_to_aws_secret_backend_role branch from 796db2a to 4e3717f Compare May 3, 2022 00:18

benashz approved these changes May 3, 2022

View reviewed changes

benashz merged commit 2d584c6 into hashicorp:main May 3, 2022

benashz mentioned this pull request May 3, 2022

Feature request: aws_secret_backend_role: missing user_path parameter #769

Closed

marcboudreau pushed a commit to marcboudreau/terraform-provider-vault that referenced this pull request Nov 6, 2022

Support setting user_path and permissions_boundary_arn fields in aws_…

bb2db77

…secret_backend_role (hashicorp#781)

thyton mentioned this pull request Nov 17, 2023

Add iam_tags to vault_aws_secret_backend_role resource #2087

Closed

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add user_path and permissions_boundary_arn arguments to aws_secret_backend_role #781

Add user_path and permissions_boundary_arn arguments to aws_secret_backend_role #781

bakeemawaytoys commented May 27, 2020

gfalqui commented Jul 10, 2020

gfalqui commented Jul 10, 2020

cyriptix commented Jul 16, 2020

billyaustin84 commented Nov 10, 2020

hashicorp-cla commented Nov 25, 2020 •

edited

Loading

bakeemawaytoys commented Nov 25, 2020

billyaustin84 commented Apr 30, 2021

billyaustin84 commented Oct 8, 2021

benashz commented Feb 10, 2022

bakeemawaytoys commented Feb 10, 2022

bakeemawaytoys commented Feb 12, 2022

benashz commented Feb 14, 2022

benashz commented Apr 29, 2022 •

edited

Loading

bakeemawaytoys commented Apr 30, 2022

benashz left a comment

benashz left a comment

Add user_path and permissions_boundary_arn arguments to aws_secret_backend_role #781

Add user_path and permissions_boundary_arn arguments to aws_secret_backend_role #781

Conversation

bakeemawaytoys commented May 27, 2020

Community Note

gfalqui commented Jul 10, 2020

gfalqui commented Jul 10, 2020

cyriptix commented Jul 16, 2020

billyaustin84 commented Nov 10, 2020

hashicorp-cla commented Nov 25, 2020 • edited Loading

bakeemawaytoys commented Nov 25, 2020

billyaustin84 commented Apr 30, 2021

billyaustin84 commented Oct 8, 2021

benashz commented Feb 10, 2022

bakeemawaytoys commented Feb 10, 2022

bakeemawaytoys commented Feb 12, 2022

benashz commented Feb 14, 2022

benashz commented Apr 29, 2022 • edited Loading

bakeemawaytoys commented Apr 30, 2022

benashz left a comment

Choose a reason for hiding this comment

benashz left a comment

Choose a reason for hiding this comment

hashicorp-cla commented Nov 25, 2020 •

edited

Loading

benashz commented Apr 29, 2022 •

edited

Loading