Terraform-provider-vault: Unable to access CSR generated by vault_generic_secret

Created on 7 Feb 2018 · 2Comments · Source: hashicorp/terraform-provider-vault

Terraform Version

Terraform v0.11.3
provider.vault v1.0.0
Vault v0.9.3

Affected Resource(s)

Just vault_generic_secret (link to docs).

Terraform Configuration Files

resource "vault_mount" "some_pki" {
    path = "some_pki"
    type = "pki"
    default_lease_ttl_seconds = "864000"
    max_lease_ttl_seconds     = "2592000" 
}

resource "vault_generic_secret" "intermediate_ca" {
    path = "${vault_mount.some_pki.path}/intermediate/generate/internal"
    disable_read = true
    data_json = <<EOF
{
    "common_name": "Some intermediate CA",
    "key_type": "ec",
    "key_bits": "384",
    "exclude_cn_from_sans": true
}
EOF
}

Debug Output

https://gist.github.com/vtorhonen/97d37eb5ff9e2aba3afaeccaeafec5c6

HTTP request:

PUT /v1/some_pki/intermediate/generate/internal HTTP/1.1
Host: vault.service.consul:8200
User-Agent: Go-http-client/1.1
Content-Length: 100
X-Vault-Token: 3b957cec-862c-f883-1908-126b96623f89
Accept-Encoding: gzip
Connection: close

{"common_name":"Some intermediate CA","exclude_cn_from_sans":true,"key_bits":"384","key_type":"ec"}

HTTP response:

HTTP/1.1 200 OK
Cache-Control: no-store
Content-Type: application/json
Date: Wed, 07 Feb 2018 19:49:45 GMT
Content-Length: 626
Connection: close

{"request_id":"f54212bd-41ff-0bed-f5bf-0553f10d0fec","lease_id":"","renewable":false,"lease_duration":0,"data":{"csr":"-----BEGIN CERTIFICATE REQUEST-----\nMIIBFjCBngIBADAfMR0wGwYDVQQDExRTb21lIGludGVybWVkaWF0ZSBDQTB2MBAG\nByqGSM49AgEGBSuBBAAiA2IABAQBa3t32/a0LTUn9ZxBKcDV3vAN8tUJuhTzG4n6\nGhCyE9qBe6OEWct1qISek5ngzPko8g1IxnrhVcuFAZZEWPWJFW3pvrUL1+4RlhPC\nPlTO/DPGIL1acFw6Rpf7WXU+gaAAMAoGCCqGSM49BAMCA2cAMGQCMH5fLhwaNnQt\nxbX0MnOKK1KQ4Y3DTrg10Cq0q8uigA4zlx7EXzITH4i2OvpZZBT5dQIwUneza0tC\ntsqgxj7M99ywdygrlYc6x0hjHzF1bYag+mWTKCaMIYCIg1NDlzuOq23O\n-----END CERTIFICATE REQUEST-----"},"wrap_info":null,"warnings":null,"auth":null}

Expected Behavior

Terraform should provide a way to access the certificate request generated by Vault.

Actual Behavior

Certificate request is generated by Vault and it is sent back to the client in the HTTP response. As seen in terraform-provider-vault/vault/resource_generic_secret.go the response data is never parsed as the implementation relies that (at least some) resources can be read after creation. However, HTTP API for Vault PKI secrets engine does not allow reading previously generated CSRs again after the initial call.

The only workaround I've come up so far is to use an external datasource. This is far from ideal and has significant caveats as the datasource if refreshed each time Terraform is run, and each refresh also generates a new intermediate CA.

#!/bin/bash

VAULT_URL="${VAULT_ADDR}/v1/pki/intermediate/generate/internal"

curl -sX PUT \
-H "X-Vault-Token: ${VAULT_TOKEN}" \
-d '{"common_name":"Some intermediate CA","exclude_cn_from_sans":true,"key_bits":"384","key_type":"ec"}' \
${VAULT_URL} | jq -Mcr '.data'

With this Terraform config:

data "external" "hack_intermediate_ca" {
    program = [ "bash", "${path.module}/scripts/hack_intermediate_ca.sh"]
}

output "intermediate_ca_csr" {
    value = "${data.external.hack_intermediate_ca.result.csr}"
}