ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/postgres/vault.tf

@@ -0,0 +1,24 @@
+# Vault's connection credential to PostgreSQL for the database engine.
+# Cannot be rotated by Vault (a service can't rotate its own bootstrap credential).
+# Password is generated once and lives in Terraform state.
+resource "random_password" "vault_db_admin" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "vault_db_admin" {
+  name        = "vault_db_admin"
+  login       = true
+  create_role = true
+  password    = random_password.vault_db_admin.result
+
+  lifecycle {
+    ignore_changes = [roles]
+  }
+}
+
+output "vault_db_admin_password" {
+  description = "Read by terraform/internal/vault via remote state to configure the database engine connection."
+  value       = random_password.vault_db_admin.result
+  sensitive   = true
+}