Open kiwimato opened 1 year ago
@kiwimato Hello, can you please confirm that your policy allows reading metadata? Based on the 403 error given for vault read prefix/data/my/path/here
this seems likely.
See https://developer.hashicorp.com/vault/docs/secrets/kv/kv-v2#acl-rules
Hello, I have a similar problem with this configuration :
[...]
resource "vault_kv_secret_v2" "input-queue" {
mount = local.vault_mount
name = "/XXXXX/${var.environment}/input-queue"
cas = 1
delete_all_versions = false
data_json = jsonencode(
{
name = aws_sqs_queue.XXXX-input-queue.name,
}
)
}
[...]
And this policy :
[...]
path "app/metadata/XXXXX/XXX/*" {
capabilities = ["read", "delete"]
}
[...]
The error :
│ Error: error writing custom metadata to /app/metadata//XXXXX/XXXXXX/input-queue, err=Error making API request.
│
│ URL: PUT https://XXXXXXXX/v1/app/metadata/XXXXX/XXXXXX/input-queue
│ Code: 403. Errors:
│
│ * 1 error occurred:
│ * permission denied
│
│
│
│ with vault_kv_secret_v2.input-queue,
│ on deployment.tf line 79, in resource "vault_kv_secret_v2" "input-queue":
│ 79: resource "vault_kv_secret_v2" "input-queue" {
│
This is weird because I'm not trying to write metadata: there is no custom_metadata
key in the resource.
Terraform Version
Affected Resource(s)
Terraform Configuration Files
Debug Output
Actual request after setting
TF_LOG=DEBUG
:Response:
Expected Behavior
The secrets get created in Vault without Terraform popping out any errors.
Actual Behavior
The Vault secrets ARE getting created, however, the command fails afterwards with the error below. After creation it also fails on
terraform plan
, I assume it tries to read data from the wrong URL after creation. I also tried using adata
instead to read whatever was created there and it gives the same error, so it might confirm it's a problem reading it.Tried debugging it, and it seems even with my admin credentials the path containing
metadata
doesn't exist but the one withdata
does:Steps to Reproduce
Please list the steps required to reproduce the issue, for example:
terraform plan
- no errors, just says it wants to create the secret.terraform apply
- errors out with permission deniedterraform plan
- errors out with permission deniedImportant Factoids
None that I know of.
References
I assume it could be related to #1719 cc @vinay-gopalan