Terraform-provider-vault: problems connecting to multiple Vaults with aliased providers

Created on 8 Dec 2017 · 6Comments · Source: hashicorp/terraform-provider-vault

Hi!

This may be more of a question then I bug, I wasn't sure and couldn't find anyone else trying something similar (possibly because it's a bad idea) so I figured I'd ask here. :)

I've got some Terraform code that manages aws resources in multiple regions, and in each region, I have a Vault cluster that I'd like to configure based on the outputs of some of my other code. I had thought to create aliases for the vault module, and the use the provider argument on the resources I needed to create, which is a patter thats worked with the aws provider, but the vault provider seems to error out when I try to connect.

So I guess question 1, is should this even work?

If so, is there something I'm missing? If not, is it a bug that it's not working as expected?

Terraform Version

09:54 $ terraform -v
Terraform v0.11.1
+ provider.aws v1.2.0
+ provider.template v1.0.0
+ provider.vault v1.0.0

Affected Resource(s)

Please list the resources as a list, for example:

the vault provider :)

Terraform Configuration Files

provider "vault" {
  address = "https://vault.us-east-1.example.com"
  alias   = "us-east-1"
  token   = "token"
  version = "1.0.0"
}

provider "vault" {
  address = "https://vault.us-west-1.example.com"
  alias   = "us-west-1"
  token   = "token"
  version = "1.0.0”
}

resource "vault_mount" "secret_us-west-1" {
  provider    = "vault.us-west-1"
  path        = "foo/secret"
  type        = "kv"
}

resource "vault_mount" "secret_us-east-1" {
  provider    = "vault.us-east-1"
  path        = "foo/secret"
  type        = "kv"
}

Expected Behavior

It was my expectation that Vault would connect to both vaults, and be able to configure and manage resources in both vaults. I was expecting a similar behavior to the aws provider when you create an alias and use the provider argument on a resource...

Actual Behavior

Running terraform plan returns permission denied errors on both vaults

Error: Error refreshing state: 2 error(s) occurred:

* provider.vault.us-east-1: failed to create limited child token: Error making API request.

URL: POST https://vault.us-east-1.example.com/v1/auth/token/create
Code: 403. Errors:

* permission denied
* provider.vault.us-west-1: failed to create limited child token: Error making API request.

URL: POST https://vault.us-west-1.example.com/v1/auth/token/create
Code: 403. Errors:

* permission denied

bug

Source

tfhartmann

👍10

All 6 comments

Hi @tfhartmann! Sorry for the delay in response. I'm not an _expert_ at provider aliases, but from what I can see, this _should_ work as you're describing it. I'm going to call this a bug, and we'll correct that if we come to a new understanding in the course of investigating it. :)

paddycarver on 30 Jan 2018

@paddycarver thanks! and no problem! If there is anything I can do to help let me know! :)

tfhartmann on 30 Jan 2018

Any update on this? We're also experiencing this issue.

Our workaround is to put the same secrets in the same environment vaults but this is not ideal.

nitrocode on 22 Aug 2019

We're running into a similar issue. Any update on this would be appreciated.

ryan-cahill on 5 Nov 2019

I got another problem if I define two providers with alises and run terrform plan I get:

    terraform plan                                                                                                      
provider.vault.address
  URL of the root of the target Vault server.

  Enter a value: ^C
Interrupt received.

meanwhile both providers have address set.
With one provider everything works.