Skip to content

Add Automated Root Rotation Parameters to AWS Auth/Secrets and DB Secrets - #2414

Merged
vinay-gopalan merged 8 commits into
mainfrom
VAULT-30242/automated-root-rotation
Mar 7, 2025
Merged

Add Automated Root Rotation Parameters to AWS Auth/Secrets and DB Secrets#2414
vinay-gopalan merged 8 commits into
mainfrom
VAULT-30242/automated-root-rotation

Conversation

@vinay-gopalan

@vinay-gopalan vinay-gopalan commented Feb 25, 2025

Copy link
Copy Markdown
Contributor

Description

Adds new automated root rotation parameters that will be available as part of Vault 1.19 Enterprise to the following resources:

  • vault_aws_secret_backend
  • vault_database_secret_backend_connection
  • vault_database_secrets_mount
  • vault_aws_auth_backend_client

Checklist

  • Added CHANGELOG entry (only for user-facing changes)
  • Acceptance tests where run against all supported Vault Versions

Output from acceptance testing:

$ make testacc TESTARGS='-run=TestAccAWSSecretBackend_automatedRotation'
=== RUN   TestAccAWSSecretBackend_automatedRotation
    resource_aws_secret_backend_test.go:167: Vault server version "1.20.0-beta1+ent"
--- PASS: TestAccAWSSecretBackend_automatedRotation (1.87s)
PASS

@vinay-gopalan
vinay-gopalan marked this pull request as ready for review March 6, 2025 01:16
@vinay-gopalan
vinay-gopalan requested a review from a team as a code owner March 6, 2025 01:16
@vinay-gopalan
vinay-gopalan requested review from a team and biazmoreira and removed request for biazmoreira March 6, 2025 01:16

import (
"context"
automatedrotationutil "github.com/hashicorp/terraform-provider-vault/internal/rotation"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe it doesn't apply to tfvp, but occasionally some linter somewhere will complain to me about this sort of import order.

kpcraig
kpcraig previously approved these changes Mar 6, 2025

@robmonte robmonte left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, only addition I can think of is a test case that can actually check if a rotation job is registered and that disable_automated_rotation removes the job, and similarly the same result when zeroing out all fields. Don't think we have the support for that level of checking yet though, so something to consider for the future.

@vinay-gopalan
vinay-gopalan merged commit 29aebe8 into main Mar 7, 2025
@vinay-gopalan

Copy link
Copy Markdown
Contributor Author

Will follow up with a docs PR

@vinay-gopalan
vinay-gopalan deleted the VAULT-30242/automated-root-rotation branch March 7, 2025 17:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants