diff --git a/CHANGELOG.md b/CHANGELOG.md index 85116ed82..f18ecd392 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,8 @@ ## Unreleased +FEATURES: +* Add support for `iam_tags` in `vault_aws_secret_backend_role` ([#2231](https://github.com/hashicorp/terraform-provider-vault/pull/2231)). + ## 4.2.0 (Mar 27, 2024) FEATURES: diff --git a/vault/resource_aws_secret_backend_role.go b/vault/resource_aws_secret_backend_role.go index 50f4d3fa4..dc62bbe8c 100644 --- a/vault/resource_aws_secret_backend_role.go +++ b/vault/resource_aws_secret_backend_role.go @@ -76,6 +76,14 @@ func awsSecretBackendRoleResource(name string) *schema.Resource { Optional: true, Description: "A list of IAM group names. IAM users generated against this vault role will be added to these IAM Groups. For a credential type of assumed_role or federation_token, the policies sent to the corresponding AWS call (sts:AssumeRole or sts:GetFederation) will be the policies from each group in iam_groups combined with the policy_document and policy_arns parameters.", }, + "iam_tags": { + Type: schema.TypeMap, + Optional: true, + Elem: &schema.Schema{ + Type: schema.TypeString, + }, + Description: "A map of strings representing key/value pairs used as tags for any IAM user created by this role.", + }, "default_sts_ttl": { Type: schema.TypeInt, Optional: true, @@ -123,6 +131,8 @@ func awsSecretBackendRoleWrite(d *schema.ResourceData, meta interface{}) error { iamGroups := d.Get("iam_groups").(*schema.Set).List() + iamTags := d.Get("iam_tags") + if policyDocument == "" && len(policyARNs) == 0 && len(roleARNs) == 0 && len(iamGroups) == 0 { return fmt.Errorf("at least one of: `policy_document`, `policy_arns`, `role_arns` or `iam_groups` must be set") } @@ -155,6 +165,9 @@ func awsSecretBackendRoleWrite(d *schema.ResourceData, meta interface{}) error { if d.HasChange("iam_groups") { data["iam_groups"] = iamGroups } + if d.HasChange("iam_tags") { + data["iam_tags"] = iamTags + } if d.HasChange("user_path") { if credentialType == "iam_user" { data["user_path"] = userPath @@ -239,6 +252,9 @@ func awsSecretBackendRoleRead(d *schema.ResourceData, meta interface{}) error { if v, ok := secret.Data["iam_groups"]; ok { d.Set("iam_groups", v) } + if v, ok := secret.Data["iam_tags"]; ok { + d.Set("iam_tags", v) + } if v, ok := secret.Data["permissions_boundary_arn"]; ok { d.Set("permissions_boundary_arn", v) } diff --git a/vault/resource_aws_secret_backend_role_test.go b/vault/resource_aws_secret_backend_role_test.go index 3cca088cb..4892a5562 100644 --- a/vault/resource_aws_secret_backend_role_test.go +++ b/vault/resource_aws_secret_backend_role_test.go @@ -27,6 +27,10 @@ const ( testAccAWSSecretBackendRolePermissionsBoundaryArn_updated = "arn:aws:iam::123456789123:policy/boundary2" testAccAWSSecretBackendRoleIamUserPath_basic = "/path1/" testAccAWSSecretBackendRoleIamUserPath_updated = "/path2/" + testAccAWSSecretBackendRoleIamTag_key_basic = "key1" + testAccAWSSecretBackendRoleIamTag_value_basic = "value1" + testAccAWSSecretBackendRoleIamTag_key_updated = "key2" + testAccAWSSecretBackendRoleIamTag_value_updated = "value2" ) func TestAccAWSSecretBackendRole_basic(t *testing.T) { @@ -167,6 +171,8 @@ func testAccAWSSecretBackendRoleCheckBasicAttributes(name, backend string) resou resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_iam_user_type_optional_attributes", "policy_arns.0", testAccAWSSecretBackendRolePolicyArn_basic), resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_iam_user_type_optional_attributes", "permissions_boundary_arn", testAccAWSSecretBackendRolePermissionsBoundaryArn_basic), resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_iam_user_type_optional_attributes", "user_path", testAccAWSSecretBackendRoleIamUserPath_basic), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_iam_user_type_optional_attributes", "iam_tags.%", "1"), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_iam_user_type_optional_attributes", fmt.Sprintf("iam_tags.%s", testAccAWSSecretBackendRoleIamTag_key_basic), testAccAWSSecretBackendRoleIamTag_value_basic), ) } @@ -205,6 +211,8 @@ func testAccAWSSecretBackendRoleCheckUpdatedAttributes(name, backend string) res resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_iam_user_type_optional_attributes", "policy_arns.0", testAccAWSSecretBackendRolePolicyArn_updated), resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_iam_user_type_optional_attributes", "permissions_boundary_arn", testAccAWSSecretBackendRolePermissionsBoundaryArn_updated), resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_iam_user_type_optional_attributes", "user_path", testAccAWSSecretBackendRoleIamUserPath_updated), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_iam_user_type_optional_attributes", "iam_tags.%", "1"), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_iam_user_type_optional_attributes", fmt.Sprintf("iam_tags.%s", testAccAWSSecretBackendRoleIamTag_key_updated), testAccAWSSecretBackendRoleIamTag_value_updated), ) } @@ -274,8 +282,17 @@ resource "vault_aws_secret_backend_role" "test_iam_user_type_optional_attributes backend = vault_aws_secret_backend.test.path permissions_boundary_arn = "%s" user_path = "%s" + iam_tags = { + %s = "%s" + } } -`, name, testAccAWSSecretBackendRolePolicyArn_basic, testAccAWSSecretBackendRolePermissionsBoundaryArn_basic, testAccAWSSecretBackendRoleIamUserPath_basic), +`, + name, + testAccAWSSecretBackendRolePolicyArn_basic, + testAccAWSSecretBackendRolePermissionsBoundaryArn_basic, + testAccAWSSecretBackendRoleIamUserPath_basic, + testAccAWSSecretBackendRoleIamTag_key_basic, + testAccAWSSecretBackendRoleIamTag_value_basic), } return strings.Join(resources, "\n") @@ -360,8 +377,17 @@ resource "vault_aws_secret_backend_role" "test_iam_user_type_optional_attributes backend = vault_aws_secret_backend.test.path permissions_boundary_arn = "%s" user_path = "%s" + iam_tags = { + %s = "%s" + } } -`, name, testAccAWSSecretBackendRolePolicyArn_updated, testAccAWSSecretBackendRolePermissionsBoundaryArn_updated, testAccAWSSecretBackendRoleIamUserPath_updated), +`, + name, + testAccAWSSecretBackendRolePolicyArn_updated, + testAccAWSSecretBackendRolePermissionsBoundaryArn_updated, + testAccAWSSecretBackendRoleIamUserPath_updated, + testAccAWSSecretBackendRoleIamTag_key_updated, + testAccAWSSecretBackendRoleIamTag_value_updated), } return strings.Join(resources, "\n") } diff --git a/website/docs/r/aws_secret_backend_role.html.md b/website/docs/r/aws_secret_backend_role.html.md index be51aec81..3bf1c1367 100644 --- a/website/docs/r/aws_secret_backend_role.html.md +++ b/website/docs/r/aws_secret_backend_role.html.md @@ -90,6 +90,9 @@ The following arguments are supported: policies from each group in `iam_groups` combined with the `policy_document` and `policy_arns` parameters. +* `iam_tags` (Optional) - A map of strings representing key/value pairs + to be used as tags for any IAM user that is created by this role. + * `default_sts_ttl` - (Optional) The default TTL in seconds for STS credentials. When a TTL is not specified when STS credentials are requested, and a default TTL is specified on the role,