From ea109b68429ab8318e6428fdf2317325bfc61648 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philipp=20B=C3=B6schen?= Date: Thu, 19 Dec 2024 10:38:18 +0100 Subject: [PATCH] Add credential_type and credential_config to static roles for DBs --- ...rce_database_secret_backend_static_role.go | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/vault/resource_database_secret_backend_static_role.go b/vault/resource_database_secret_backend_static_role.go index b627351e1..ab9ee14d3 100644 --- a/vault/resource_database_secret_backend_static_role.go +++ b/vault/resource_database_secret_backend_static_role.go @@ -26,6 +26,8 @@ var staticRoleFields = []string{ consts.FieldRotationPeriod, consts.FieldRotationStatements, consts.FieldDBName, + consts.FieldCredentialType, + consts.FieldCredentialConfig, } func databaseSecretBackendStaticRoleResource() *schema.Resource { @@ -99,6 +101,20 @@ func databaseSecretBackendStaticRoleResource() *schema.Resource { Description: "The password corresponding to the username in the database. " + "Required when using the Rootless Password Rotation workflow for static roles.", }, + consts.FieldCredentialType: { + Type: schema.TypeString, + Optional: true, + Default: "password", + Description: "The credential type for the user, can be one of \"password\", \"rsa_private_key\" or \"client_certificate\"." + + "The configuration can be done in `credential_config`.", + }, + consts.FieldCredentialConfig: { + Type: schema.TypeMap, + Elem: &schema.Schema{Type: schema.TypeString}, + Optional: true, + Description: "The configuration for the credential type." + + "Full documentation for the allowed values can be found under \"https://developer.hashicorp.com/vault/api-docs/secret/databases#credential_config\".", + }, }, } } @@ -138,6 +154,14 @@ func databaseSecretBackendStaticRoleWrite(ctx context.Context, d *schema.Resourc data[consts.FieldRotationPeriod] = v } + if v, ok := d.GetOk(consts.FieldCredentialType); ok && v != "" { + data[consts.FieldCredentialType] = v + } + + if v, ok := d.GetOk(consts.FieldCredentialConfig); ok && v != "" { + data[consts.FieldCredentialConfig] = v + } + if provider.IsAPISupported(meta, provider.VaultVersion118) && provider.IsEnterpriseSupported(meta) { if v, ok := d.GetOk(consts.FieldSelfManagedPassword); ok && v != "" { data[consts.FieldSelfManagedPassword] = v