vault_database_secret_backend_connection don't accept plugin_name key

[JnMik]

Terraform Version

vault v0.12.12
provider.vault v2.6.0

Affected Resource(s)

vault_database_secret_backend_connection

Terraform Configuration Files

resource "vault_database_secret_backend_connection" "mongodb-atlas" {
  backend       = "${vault_mount.mongodb-atlas.path}"
  name          = "mongodb-atlas"
  allowed_roles = [
      ...  
  ]

  plugin_name = "mongodb-atlas-plugin"

  data = {
    public_key = "xxx"
    private_key = "xxx"
    project_id = "xxx"
  }
}

Expected Behavior

Resource should accept plugin_name property to pass custom plugins

Actual Behavior

An argument named "plugin_name" is not expected here.

I also tried with plugin_name in the data field but had the error Error: at least one database plugin must be configured

[whume]

Is there an update on this now that mongodb atlas is officially supported it would be good if we could use terraform for this.

[iiro]

Any updates on this...? Definitely needed for managing the setup with Terraform...

[angeloskaltsikis]

@iiro According to the docs i believe that while there is no way to currently specify which plugin you want, you can use the specific blocks (for example mysql or aurora_rds) to specify which plugin you want to use.
Makes sense to you?

[benashz]

Closed by #1320

[pedroduarteid]

Hi @benashz, how are you?

I have configured my terraform file by passing the value "plugin_name" but it is not recognized in the "terraform plan" command. I'm using version 3.2.1 (required provider - main.tf) in my code.

How do I make use of this feature?

This is my block code resource.

resource "vault_database_secret_backend_connection" "mongodbatlas" {
    backend = vault_mount.mongodbatlas.path
    plugin_name = "mongodbatlas-database-plugin"
    name = var.mount_name
    allowed_roles = [var.role_name]
}

My config Terraform

Terraform v1.1.6
Provider Vault - 3.2.1
Vault - v1.9.3

I tried without passing "plugin_name" and result is:

I appreciate your support! Thanks.

[benashz]

Hi @pedroduarteid , this is fixed in https://github.com/hashicorp/terraform-provider-vault/releases/tag/v3.3.0 . Please let us know if you continue to encounter this issue.

Thanks,

Ben

[pedroduarteid]

Hi @benashz
I will evaluate it today and as soon as I have the result I will update you here.

Thanks,
Pedro

[pedroduarteid]

Hi @benashz

I evaluated and the command "terraform apply" shows the error below.

Using the "vault write..." command I configured the database engine to mongodbatlas normally. However, I believe there is some configuration missing to be able to run through terraform. But I could not find any parameters for that.

Documents I've consulted.:
https://registry.terraform.io/providers/hashicorp/vault/latest/docs/resources/database_secret_backend_connection
https://registry.terraform.io/providers/mongodb/mongodbatlas/latest/docs

[benashz]

HI @pedroduarteid ,

I think you might be missing database specific configuration. See https://registry.terraform.io/providers/hashicorp/vault/latest/docs/resources/database_secret_backend_connection#mongodb-atlas-configuration-options for more details.

[pedroduarteid]

I believed that not...
I have trying before used these options but have errors.

By the best pratices not is correct to be use credentials in the configurations files...

I have tried several ways to use these parameters and it is not accepted by "terraform plan...apply"...etc...

[benashz]

I think you only need to move public_key and private_key into the resource's mongodbatlas block:

Example:

resource "vault_database_secret_backend_connection" "test" {
  backend = vault_mount.db.path
  name = "...."

  mongodbatlas {
    public_key  = "your public key"
    private_key = "your private key"
    project_id  = "your project ID"
  }
}

[pedroduarteid]

Same error. I made this configuration.
This point of configuration is provider of MongoDBAtlas, not of Vault.

[benashz]

You need to pass a string for all those fields. What you have there are lists, which is not what the provider expects.

[pedroduarteid]

Yes, @benashz
It is now possible to perform the configuration in Vault through Terraform.

The values are passing in time of execution with "terraform apply" to nothing save inside files config.

Thanks!
Pedro Duarte