aboutsummaryrefslogtreecommitdiffstats
path: root/fdio.infra.terraform/1n_nmd/vault-aws-secret-backend/main.tf
diff options
context:
space:
mode:
Diffstat (limited to 'fdio.infra.terraform/1n_nmd/vault-aws-secret-backend/main.tf')
-rw-r--r--fdio.infra.terraform/1n_nmd/vault-aws-secret-backend/main.tf37
1 files changed, 37 insertions, 0 deletions
diff --git a/fdio.infra.terraform/1n_nmd/vault-aws-secret-backend/main.tf b/fdio.infra.terraform/1n_nmd/vault-aws-secret-backend/main.tf
new file mode 100644
index 0000000000..a65c390792
--- /dev/null
+++ b/fdio.infra.terraform/1n_nmd/vault-aws-secret-backend/main.tf
@@ -0,0 +1,37 @@
+resource "vault_aws_secret_backend" "aws" {
+ access_key = var.aws_access_key
+ secret_key = var.aws_secret_key
+ path = "${var.name}-path"
+
+ default_lease_ttl_seconds = "0"
+ max_lease_ttl_seconds = "0"
+}
+
+resource "vault_aws_secret_backend_role" "admin" {
+ backend = vault_aws_secret_backend.aws.path
+ name = "${var.name}-role"
+ credential_type = "iam_user"
+
+ policy_document = <<EOF
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": [
+ "iam:*", "ec2:*"
+ ],
+ "Resource": "*"
+ }
+ ]
+}
+EOF
+}
+
+output "backend" {
+ value = vault_aws_secret_backend.aws.path
+}
+
+output "role" {
+ value = vault_aws_secret_backend_role.admin.name
+}