diff --git a/changelogs/fragments/27-add-hashi_vault-header_value-param.yml b/changelogs/fragments/27-add-hashi_vault-header_value-param.yml new file mode 100644 index 000000000..7f783ee26 --- /dev/null +++ b/changelogs/fragments/27-add-hashi_vault-header_value-param.yml @@ -0,0 +1,2 @@ +minor_changes: + - Add optional ``aws_iam_server_id`` parameter as the value for ``X-Vault-AWS-IAM-Server-ID`` header (https://github.com/ansible-collections/community.hashi_vault/pull/27). diff --git a/plugins/lookup/hashi_vault.py b/plugins/lookup/hashi_vault.py index f7d924945..df8dfc5ff 100644 --- a/plugins/lookup/hashi_vault.py +++ b/plugins/lookup/hashi_vault.py @@ -163,6 +163,14 @@ env: - name: EC2_REGION - name: AWS_REGION + aws_iam_server_id: + description: If specified, sets the value to use for the C(X-Vault-AWS-IAM-Server-ID) header as part of C(GetCallerIdentity) request. + env: + - name: ANSIBLE_HASHI_VAULT_AWS_IAM_SERVER_ID + ini: + - section: lookup_hashi_vault + key: aws_iam_server_id + required: False """ EXAMPLES = """ @@ -635,6 +643,9 @@ def validate_auth_aws_iam_login(self, auth_method): if self.get_option('region'): params['region'] = self.get_option('region') + if self.get_option('aws_iam_server_id'): + params['header_value'] = self.get_option('aws_iam_server_id') + if not (params['access_key'] and params['secret_key']): profile = self.get_option('aws_profile') if profile: