[Enhancement]: copy-paste compatibility with `vault_policy_document`

[nfi-hashicorp]

Description

It's a little strange that you can't just copy-paste an existing Vault policy HCL file into the body of a vault_policy_document?

Why this:

data "vault_policy_document" "example" {
  rule {
    path         = "secret/*"
    capabilities = ["create", "read", "update", "delete", "list"]
    description  = "allow all on secrets"
  }
}

And not this:

data "vault_policy_document" "example" {
  path "secret/*" {
    capabilities = ["create", "read", "update", "patch", "delete", "list"]
  }
}

Obviously it's too late to change now without breaking stuff, but maybe a mapping in the docs would be nice?

Affected Resource(s) and/or Data Source(s)

data vault_policy_document

Potential Terraform Configuration

data "vault_policy_document" "example" {
  rule {
    path         = "secret/*"
    capabilities = ["create", "read", "update", "delete", "list"]
    description  = "allow all on secrets"
  }
}

References

No response

Would you like to implement a fix?

None

[fairclothjm]

@nfi-hashicorp Hello! The vault_policy resource should allow you to copy-paste the hcl directly. Does that work for your use case?

[nfi-hashicorp]

Um, not quite. It does let you copy-paste directly, yes, but I was hoping for real HCL, not HCL in a string. For syntax highlighting, linting, etc.

[fairclothjm]

@nfi-hashicorp Thanks for the clarification. In that case, I think you could write the vault policy as a separate file and then use the file function?

Something like:

resource "vault_policy" "example" {
  name = "dev-team"

  policy = file("${path.module}/policy.hcl")
}

policy.hcl

path "secret/my_app" {
  capabilities = ["update"]
}

[nfi-hashicorp]

@nfi-hashicorp Thanks for the clarification. In that case, I think you could write the vault policy as a separate file and then use the file function?

Right, but I'm also going to want to insert values from terraform. Of course, I could use templatefile, but that's string templating at the end of the day.

To clarify, I can think of a thousand ways to accomplish the task at hand, and those work okay. Keeping it structured has lots of UX benefits:

• validation at plan time, and potentially at authorship time in the IDE
• structured diffs