Infra: Vault

[csit.git] / fdio.infra.terraform / 1n_nmd / aws / main.tf

diff --git a/fdio.infra.terraform/1n_nmd/aws/main.tf b/fdio.infra.terraform/1n_nmd/aws/main.tf
new file mode 100644 (file)
index 0000000..6768203
--- /dev/null
+++ b/fdio.infra.terraform/1n_nmd/aws/main.tf
@@ -0,0 +1,37 @@
+resource "vault_aws_secret_backend" "aws" {
+  access_key                = var.aws_access_key
+  secret_key                = var.aws_secret_key
+  path                      = "${var.name}-path"
+
+  default_lease_ttl_seconds = "120"
+  max_lease_ttl_seconds     = "240"
+}
+
+resource "vault_aws_secret_backend_role" "admin" {
+  backend                   = vault_aws_secret_backend.aws.path
+  name                      = "${var.name}-role"
+  credential_type           = "iam_user"
+
+  policy_document           = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "iam:*", "ec2:*"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+EOF
+}
+
+output "backend" {
+  value                     = vault_aws_secret_backend.aws.path
+}
+
+output "role" {
+  value                     = vault_aws_secret_backend_role.admin.name
+}
\ No newline at end of file