Terraform-provider-vault: Support Database Root Credential Rotation

[StyleT]

Hi!
In Vault 0.10.0 support of the Database Root Credential Rotation was added. From my standpoint to accommodate this change we need to add support of the username and password fields to the database_secret_backend_connection resource to have ability to use new API.
Additionally to make functionality complete I think there should be a boolean option rotate_root_on_update that invokes /database/rotate-root if password was changed in TF.

Provider Version

1.1.4

[StyleT]

Started some work here: https://github.com/StyleT/terraform-provider-vault/tree/feature/202_root_credentials_rotation

Guys, pls tell if it makes sense for you

[sidewinder12s]

Makes total sense to me, though I don't work for HashiCorp :)

[ahilsend]

I think so too. I already opened a PR for configuring username, and password in https://github.com/terraform-providers/terraform-provider-vault/pull/208 for this.

I also prepared a branch which has a vault_database_secret_backend_rotate_root resource. Though I'm waiting with opening a PR for it until I get feedback on the other one.
https://github.com/ahilsend/terraform-provider-vault/commits/database-root-rotate

[sidewinder12s]

Why not just make it a parameter on the database_secret_backend_connection resource?

[ahilsend]

I was considering that, but I would mean the credentials would only be rotated once on creation. Maybe on updates.
Whereas a separate resource can always require a change, and be triggered every time it runs.

It also makes the logic in the database_secret_backend_connection much simpler. How do you deal with a successful connection update, but a failed rotation? Introducing partial state updates seamed trickier than a separate resource.

That was my thinking anyway, open to other suggestions.

[sidewinder12s]

That's true. I guess my understanding from the way the credential rotation was described was that you'd only ever do it once on ingestion since then only Vault has the credential.

[gitevanx]

Any news on this?

[boekkooi-fresh]

In regard to rotating on creation it is possible to use vault_generic_endpoint to replicate vault write -force database/rotate-root/postgresql.

This could look something like:

resource "vault_generic_endpoint" "rotate_initial_db_password" {
  depends_on           = [vault_database_secret_backend_connection.postgres]
  path                 = "database/rotate-root/${vault_database_secret_backend_connection.postgres.name}"
  disable_read   = true
  disable_delete = true

  data_json = "{}"
}