initial commit

terraform/vault-debmini/main.tf

@@ -0,0 +1,66 @@
+resource "vault_token" "superuser" {
+  policies = ["super-user"]
+  display_name = "superuser"
+  renewable = true
+  ttl = "768h"
+  metadata = {
+   "purpose" = "service account for managing vault"
+  }
+  lifecycle {
+   create_before_destroy = true
+  }
+}
+
+resource "vault_policy" "super_user" {
+  name = "super-user"
+  policy = <<EOT
+path "sys/policies/acl" {
+    capabilities = ["list"]
+}
+path "sys/policies/acl/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "auth/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "sys/auth/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "sys/auth" {
+    capabilities = ["read"]
+}
+path "identity/*" {
+    capabilities = ["create", "read", "update", "delete", "list"]
+}
+path "secret/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "pki/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "pki_root/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "pki_intermediate/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "sys/leases/*" {
+    capabilities = ["read", "update", "list"]
+}
+path "sys/namespaces/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "sys/mounts" {
+    capabilities = ["read"]
+}
+path "sys/internal/ui/mounts" {
+    capabilities = ["read"]
+}
+path "sys/license" {
+    capabilities = ["create", "read", "update", "delete", "list"]
+}
+path "sys/config/ui" {
+    capabilities = ["read", "update", "delete", "list"]
+}
+EOT
+}