Terraform-provider-vault: vault_policy needs import support

[stobias123]

Hi there,
We have a bunch of existing policies we've written into vault manually. I'm trying to migrate these policies to terraform so we can manage them a little more cleanly. I can't run an apply due to the risk of screwing with production policies / policy attachments.

Terraform Version

(mybranch)⚡ % terraform -v                                                                                                                                     ~/repos/terraform/vault
Terraform v0.11.3
+ provider.vault v1.0.0

Affected Resource(s)

Please list the resources as a list, for example:

• vault_policy

Terraform Configuration Files

provider "vault" {
  address = "http://vault.com.pany"
}

resource "vault_policy" "myapp-dev" {
  name   = "myapp-dev"
  policy = "${file("${path.module}/policy/applications/myapp-dev.hcl")}"
}

Expected Behavior

No new key should be created.

Actual Behavior

Terraform plan shows creating a new key at the target location

(mybranch)⚡ [1] % vault read sys/policy/myapp-dev                                                                                                               
Key     Value
---     -----
name    myapp-dev
rules   path "secret/directory/myapp/dev/*" {
  capabilities = ["create","read","update","delete","list"]
}

(mybranch)⚡ % vault policies myapp-dev                                                                                                                         
path "secret/directory/myapp/dev/*" {
  capabilities = ["create","read","update","delete","list"]
}


## Terraform (plan) output
...
+ create 
...
+ vault_policy.myapp-dev
    id:     <computed>
    name:   "myapp-dev"
    policy: "path \"secret/directory/myapp/dev/*\" {\n  capabilities = [\"create\",\"read\",\"update\",\"delete\",\"list\"]\n}\n"

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. Create a policy at `sys/policy/foo' Manually
2. Create an HCL / .tf file that mirrors that policy's implementation
3. terraform plan

[vancluever]

Hey @stobias123, you definitely don't want to run this against Vault if you have a pre-existing policy for this. What optimally should be done is you should import the resource with terraform import, but right now, it doesn't appear this resource supports it.

I've added this as an enhancement so it can be worked on.

Thanks!

PS: I've adjusted the subject accordingly only so that we can see this better.

[sidewinder12s]

@vancluever Doesn't this PR add support for importing policies? #15