vault-terraform

Vault (Terraform)

Overview

The Vault Terraform provider manages Vault resources declaratively. 188+ resources, 38+ data sources, and 16 ephemeral resources for write-once secret patterns.

Provider: hashicorp/vault 5.9.0.

Resources by category:

Category	Resources	Examples
Auth Backends	10+	vault_auth_backend, vault_kubernetes_auth_backend_config, vault_approle_auth_backend_role
Secrets Engines	20+	vault_mount, vault_kv_secret_v2, vault_transit_secret_backend_key
Policies	4	vault_policy, vault_egp_policy (enterprise)
Identity	8+	vault_identity_entity, vault_identity_entity_alias, vault_identity_group, vault_identity_group_member_entity_ids
PKI	20+	vault_pki_secret_backend_root_cert, vault_pki_secret_backend_role
Database	15+	vault_database_secret_backend_connection, vault_database_secret_backend_role
Token	5	vault_token, vault_token_auth_backend_role
Raft	2	vault_raft_snapshot_agent_config

Provider Configuration

provider "vault" {
  address         = "http://vault.vault:8200"
  token           = var.vault_root_token   # or use Vault_TOKEN env var
  skip_child_token = true                  # avoid child token creation per module
}

Auth via environment (alternative):

export VAULT_ADDR=http://vault.vault:8200
export VAULT_TOKEN=hvs...

Common Resource Patterns

Kubernetes Auth Backend

# Enable K8s auth
resource "vault_auth_backend" "kubernetes" {
  type = "kubernetes"
  path = "kubernetes"
}

# Configure K8s auth (in-cluster)
resource "vault_kubernetes_auth_backend_config" "config" {
  backend            = vault_auth_backend.kubernetes.path
  kubernetes_host    = "https://${var.kubernetes_service_host}:443"
  kubernetes_ca_cert = filebase64(var.k8s_ca_cert_path)
  issuer             = "https://kubernetes.default.svc.cluster.local"
}

# Create role for ESO
resource "vault_kubernetes_auth_backend_role" "eso" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "eso-reader"
  bound_service_account_names      = ["external-secrets"]
  bound_service_account_namespaces = ["external-secrets"]
  token_policies                   = ["eso-reader"]
  token_ttl                        = 3600
}