Chore: Refactor Authen

authentication/policy.tf

@@ -0,0 +1,5 @@
+resource "vault_policy" "policies" {
+  name     = split(".", each.value)[0]
+  policy   = file("${path.module}/templates/policy/${each.value}")
+  for_each = fileset("${path.module}/templates/policy/", "*.hcl")
+}

authentication/templates/default_template.tftpl

@@ -1,4 +1,4 @@
 {
     "policies": [%{ for i,policy in policies ~}"${policy}"%{if i < length(policies) -1 }, %{ endif }%{~ endfor ~}],
-    "password": "password"
+    "password": "${password}"
 }

policy/templates/admin_policy.hcl → authentication/templates/policy/admin_policy.hcl

@@ -74,4 +74,11 @@ path "kv-v2/*"
 path "sys/health"
 {
   capabilities = ["read", "sudo"]
-}
+}
+
+# Update Certs
+path "certs_int/*"
+{
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+

authentication/templates/users.json.example

@@ -0,0 +1,7 @@
+[
+    {
+        "username": "viewer",
+        "password": "password123",
+        "policies": ["view_policy"]
+    }
+]

authentication/userpass.tf

@@ -1,29 +1,18 @@
+locals {
+  users = jsondecode(file("${path.module}/templates/users.json"))
+}
+
 resource "vault_auth_backend" "userpass" {
   type        = "userpass"
   path        = var.path
   description = "Main userpass authentication"
 }
 
-resource "vault_generic_endpoint" "devops_user" {
+resource "vault_generic_endpoint" "users" {
+  for_each             = { for user in local.users : user.username => user }
   depends_on           = [vault_auth_backend.userpass]
-  path                 = "auth/userpass/users/devops_user"
+  path                 = "auth/userpass/users/${each.value.username}"
   ignore_absent_fields = true
 
-  data_json = templatefile("${path.module}/templates/default_template.tftpl", { policies = sort(["default", "admin_policy"]) })
+  data_json = templatefile("${path.module}/templates/default_template.tftpl", { policies = sort(each.value.policies), password = each.value.password })
 }
-
-resource "vault_generic_endpoint" "root_user" {
-  depends_on           = [vault_auth_backend.userpass]
-  path                 = "auth/userpass/users/root"
-  ignore_absent_fields = true
-
-  data_json = templatefile("${path.module}/templates/default_template.tftpl", { policies = sort(["default", "root_policy"]) })
-}
-
-resource "vault_generic_endpoint" "view_user" {
-  depends_on           = [vault_auth_backend.userpass]
-  path                 = "auth/userpass/users/viewer"
-  ignore_absent_fields = true
-
-  data_json = templatefile("${path.module}/templates/default_template.tftpl", { policies = sort(["default", "view_policy"]) })
-}

main.tf

@@ -1,7 +1,3 @@
-module "policy" {
-  source = "./policy"
-}
-
 module "authentication" {
   source = "./authentication"
   path   = "userpass"