X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=fdio.infra.terraform%2Fterraform-vault-aws-secret-backend%2Fmain.tf;fp=fdio.infra.terraform%2Fterraform-vault-aws-secret-backend%2Fmain.tf;h=a65c390792f442f4bcff6127132000a87f75f69f;hb=ca81b6ccfdcee62846217f824c1e4a1610b8a950;hp=0000000000000000000000000000000000000000;hpb=e972e67afac3ab3eb785668d01d3bdf1833eade9;p=csit.git

diff --git a/fdio.infra.terraform/terraform-vault-aws-secret-backend/main.tf b/fdio.infra.terraform/terraform-vault-aws-secret-backend/main.tf
new file mode 100644
index 0000000000..a65c390792
--- /dev/null
+++ b/fdio.infra.terraform/terraform-vault-aws-secret-backend/main.tf
@@ -0,0 +1,37 @@
+resource "vault_aws_secret_backend" "aws" {
+  access_key = var.aws_access_key
+  secret_key = var.aws_secret_key
+  path       = "${var.name}-path"
+
+  default_lease_ttl_seconds = "0"
+  max_lease_ttl_seconds     = "0"
+}
+
+resource "vault_aws_secret_backend_role" "admin" {
+  backend         = vault_aws_secret_backend.aws.path
+  name            = "${var.name}-role"
+  credential_type = "iam_user"
+
+  policy_document = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "iam:*", "ec2:*"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+EOF
+}
+
+output "backend" {
+  value = vault_aws_secret_backend.aws.path
+}
+
+output "role" {
+  value = vault_aws_secret_backend_role.admin.name
+}