# Vault's connection credential to PostgreSQL for the database engine.
# Cannot be rotated by Vault (a service can't rotate its own bootstrap credential).
# Password is generated once and lives in Terraform state.
resource "random_password" "vault_db_admin" {
  length  = 32
  special = false
}

resource "postgresql_role" "vault_db_admin" {
  name        = "vault_db_admin"
  login       = true
  create_role = true
  password    = random_password.vault_db_admin.result

  lifecycle {
    ignore_changes = [roles]
  }
}

output "vault_db_admin_password" {
  description = "Read by terraform/internal/vault via remote state to configure the database engine connection."
  value       = random_password.vault_db_admin.result
  sensitive   = true
}