Add allowed_serial_numbers support (Forked hashicorp#1119) (hashicorp#1441)

Co-authored-by: Geoff Childs <geoff.childs@adalpha.io>

Author: 2 people

vault/resource_pki_secret_backend_role.go

@@ -312,6 +312,15 @@ func pkiSecretBackendRoleResource() *schema.Resource {
 				Description:  "Specifies the duration by which to backdate the NotBefore property.",
 				ValidateFunc: validateDuration,
 			},
+			"allowed_serial_numbers": {
+				Type:        schema.TypeList,
+				Required:    false,
+				Optional:    true,
+				Description: "Defines allowed Subject serial numbers.",
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
 		},
 	}
 }
@@ -350,6 +359,12 @@ func pkiSecretBackendRoleCreate(d *schema.ResourceData, meta interface{}) error
 		policyIdentifiers = append(policyIdentifiers, iIdentifier.(string))
 	}
 
+	iAllowedSerialNumbers := d.Get("allowed_serial_numbers").([]interface{})
+	allowedSerialNumbers := make([]string, 0, len(iAllowedSerialNumbers))
+	for _, iSerialNumber := range iAllowedSerialNumbers {
+		allowedSerialNumbers = append(allowedSerialNumbers, iSerialNumber.(string))
+	}
+
 	data := map[string]interface{}{
 		"ttl":                                d.Get("ttl"),
 		"max_ttl":                            d.Get("max_ttl"),
@@ -401,6 +416,10 @@ func pkiSecretBackendRoleCreate(d *schema.ResourceData, meta interface{}) error
 		data["policy_identifiers"] = policyIdentifiers
 	}
 
+	if len(allowedSerialNumbers) > 0 {
+		data["allowed_serial_numbers"] = allowedSerialNumbers
+	}
+
 	log.Printf("[DEBUG] Creating role %s on PKI secret backend %q", name, backend)
 	_, err := client.Logical().Write(path, data)
 	if err != nil {
@@ -473,6 +492,12 @@ func pkiSecretBackendRoleRead(d *schema.ResourceData, meta interface{}) error {
 
 	notBeforeDuration := flattenVaultDuration(secret.Data["not_before_duration"])
 
+	iAllowedSerialNumbers := secret.Data["allowed_serial_numbers"].([]interface{})
+	allowedSerialNumbers := make([]string, 0, len(iAllowedSerialNumbers))
+	for _, iSerialNumber := range iAllowedSerialNumbers {
+		allowedSerialNumbers = append(allowedSerialNumbers, iSerialNumber.(string))
+	}
+
 	d.Set("backend", backend)
 	d.Set("name", name)
 	d.Set("ttl", secret.Data["ttl"])
@@ -511,6 +536,7 @@ func pkiSecretBackendRoleRead(d *schema.ResourceData, meta interface{}) error {
 	d.Set("policy_identifiers", policyIdentifiers)
 	d.Set("basic_constraints_valid_for_non_ca", secret.Data["basic_constraints_valid_for_non_ca"])
 	d.Set("not_before_duration", notBeforeDuration)
+	d.Set("allowed_serial_numbers", allowedSerialNumbers)
 
 	return nil
 }
@@ -545,6 +571,12 @@ func pkiSecretBackendRoleUpdate(d *schema.ResourceData, meta interface{}) error
 		policyIdentifiers = append(policyIdentifiers, iIdentifier.(string))
 	}
 
+	iAllowedSerialNumbers := d.Get("allowed_serial_numbers").([]interface{})
+	allowedSerialNumbers := make([]string, 0, len(iAllowedSerialNumbers))
+	for _, iSerialNumber := range iAllowedSerialNumbers {
+		allowedSerialNumbers = append(allowedSerialNumbers, iSerialNumber.(string))
+	}
+
 	data := map[string]interface{}{
 		"ttl":                                d.Get("ttl"),
 		"max_ttl":                            d.Get("max_ttl"),
@@ -596,6 +628,10 @@ func pkiSecretBackendRoleUpdate(d *schema.ResourceData, meta interface{}) error
 		data["policy_identifiers"] = policyIdentifiers
 	}
 
+	if len(allowedSerialNumbers) > 0 {
+		data["allowed_serial_numbers"] = allowedSerialNumbers
+	}
+
 	_, err := client.Logical().Write(path, data)
 	if err != nil {
 		return fmt.Errorf("error updating PKI secret backend role %q: %s", path, err)

vault/resource_pki_secret_backend_role_test.go

@@ -67,6 +67,7 @@ func TestPkiSecretBackendRole_basic(t *testing.T) {
 					resource.TestCheckResourceAttr("vault_pki_secret_backend_role.test", "policy_identifiers.0", "1.2.3.4"),
 					resource.TestCheckResourceAttr("vault_pki_secret_backend_role.test", "basic_constraints_valid_for_non_ca", "false"),
 					resource.TestCheckResourceAttr("vault_pki_secret_backend_role.test", "not_before_duration", "45m"),
+					resource.TestCheckResourceAttr("vault_pki_secret_backend_role.test", "allowed_serial_numbers.0", "*"),
 				),
 			},
 			{
@@ -116,6 +117,7 @@ func TestPkiSecretBackendRole_basic(t *testing.T) {
 					resource.TestCheckResourceAttr("vault_pki_secret_backend_role.test", "policy_identifiers.0", "1.2.3.4"),
 					resource.TestCheckResourceAttr("vault_pki_secret_backend_role.test", "basic_constraints_valid_for_non_ca", "false"),
 					resource.TestCheckResourceAttr("vault_pki_secret_backend_role.test", "not_before_duration", "45m"),
+					resource.TestCheckResourceAttr("vault_pki_secret_backend_role.test", "allowed_serial_numbers.0", "*"),
 				),
 			},
 		},
@@ -168,6 +170,7 @@ resource "vault_pki_secret_backend_role" "test" {
   policy_identifiers = ["1.2.3.4"]
   basic_constraints_valid_for_non_ca = false
   not_before_duration = "45m"
+  allowed_serial_numbers = ["*"]
 }`, path, name)
 }
 
@@ -218,6 +221,7 @@ resource "vault_pki_secret_backend_role" "test" {
   policy_identifiers = ["1.2.3.4"]
   basic_constraints_valid_for_non_ca = false
   not_before_duration = "45m"
+  allowed_serial_numbers = ["*"]
 }`, path, name)
 }
 

website/docs/r/pki_secret_backend_role.html.md

@@ -113,6 +113,8 @@ The following arguments are supported:
 
 * `not_before_duration` - (Optional) Specifies the duration by which to backdate the NotBefore property.
 
+* `allowed_serial_numbers` - (Optional) An array of allowed serial numbers to put in Subject
+
 ## Attributes Reference
 
 No additional attributes are exported by this resource.