Venafi / terraform-provider-venafi

HashiCorp Terraform provider that uses Venafi to streamline machine identity (certificate and key) acquisition.
https://www.terraform.io/docs/providers/venafi/
Mozilla Public License 2.0
16 stars 20 forks source link

No validation for expiration_window constraint #82

Closed luispresuelVenafi closed 1 year ago

luispresuelVenafi commented 2 years ago

PROBLEM SUMMARY If you request a certificate with an expiration window greater than its duration will trigger an error that won't let to execute terraform plan or terraform plan -destroy. This is due to previous expected behavior to delegate to the user the correct input for the expiration_window and a certificate_duration that complies: expiration_window <= certificate_duration

STEPS TO REPRODUCE

EXPECTED RESULTS The request shouldn't have occurred in the first place.

ACTUAL RESULTS Certificate is enrolled leaving a bad state in the Terraform configuration file (a certificate that cannot be handled).

ENVIRONMENT DETAILS VaaS Venafi Terraform Provider version 0.15.2 (this applicable from first version)

COMMENTS/WORKAROUNDS As mentioned above, this is due to previous expected behavior to delegate to the user the correct input for the expiration_window and a certificate_duration that complies: expiration_window <= certificate_duration. The workaround would be to abide the constraint of:

expiration_window <= certificate_duration

during certificate enroll.

luispresuelVenafi commented 1 year ago

This was addressed in v0.15.3.