Adding Entities to Vault Namespaces,Groups, or Policies Terraform

Question

I'm having an issue with the Vault Terraform. I am able to create Entities, Namespaces, Groups, and policies but linking them together is not happening for me. I can get the policy added to the group just fine, but adding members to that group I cannot.

Here's what I have so far:

# module.users returns vault_identity_entity.entity.id
data "vault_identity_entity" "user_lookup" {
  for_each    = toset([for user in local.groups : user.name])
  entity_name = each.key

  depends_on = [
    module.users
  ]
}

# module.devops_namespace returns vault_namespace.namespace.path
resource "vault_identity_group" "devops" {
  depends_on = [
    vault_policy.policy
  ]
  name = "devops_users"
  namespace         = module.devops_namespace.vault_namespace
  member_entity_ids = [for user in data.vault_identity_entity.user_lookup : jsondecode(user.data_json).id]
}

resource "vault_identity_group_policies" "default" {
  policies = [vault_policy.gitlab_policy.name]
  exclusive = false
  group_id = vault_identity_group.devops.id
}

What I need to do is create a namespace and add users and a policy to that namespace.

Any help would be appreciated, thanks!

no errors come up. The output says the group gets created `vault_identity_group.devops_users: Creation complete after 0s` but the users aren't in the group — Stacker, Jul 02 '22 at 16:52
Ok, and what happens if you try the following: `member_entity_ids = [for user in values(data.vault_identity_entity.user_lookup) : jsondecode(user.data_json).id]`? — Marko E, Jul 02 '22 at 16:54
Let us [continue this discussion in chat](https://chat.stackoverflow.com/rooms/246121/discussion-between-stacker-and-marko-e). — Stacker, Jul 02 '22 at 17:02

score 0 · Accepted Answer · answered Jul 02 '22 at 17:51


resource "vault_policy" "namespace" {
  depends_on = [module.namespace]
  name       = "namespace"
  policy     = file("policies/namespace.hcl")
  namespace  = "devops"
}

resource "vault_identity_group" "devops" {
  depends_on = [
    module.users
  ]
  name              = "devops_users"
  namespace         = module.devops_namespace.vault_namespace
  policies          = [vault_policy.gitlab_policy.name]
  member_entity_ids = [for user in module.users : user.entity_id]
}

By referring the users the module created I was able to achieve the correct result.

Since the module created the users from locals and the data resource was trying to pull down the same users, the extra data resource section wasn't needed.

Thank you Marko E!

Adding Entities to Vault Namespaces,Groups, or Policies Terraform

1 Answers1