24 lines
747 B
Terraform
24 lines
747 B
Terraform
|
# Vault's connection credential to PostgreSQL for the database engine.
|
||
|
|
# Cannot be rotated by Vault (a service can't rotate its own bootstrap credential).
|
||
|
|
# Password is generated once and lives in Terraform state.
|
||
|
|
resource "random_password" "vault_db_admin" {
|
||
|
|
length = 32
|
||
|
|
special = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "postgresql_role" "vault_db_admin" {
|
||
|
|
name = "vault_db_admin"
|
||
|
|
login = true
|
||
|
|
create_role = true
|
||
|
|
password = random_password.vault_db_admin.result
|
||
|
|
|
||
|
|
lifecycle {
|
||
|
|
ignore_changes = [roles]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
output "vault_db_admin_password" {
|
||
|
|
description = "Read by terraform/internal/vault via remote state to configure the database engine connection."
|
||
|
|
value = random_password.vault_db_admin.result
|
||
|
|
sensitive = true
|
||
|
|
}
|