terraform-provider/docs/resources/dynamic_secret_aws_iam.md

page_title, subcategory, description

page_title	subcategory	description
kms_dynamic_secret_aws_iam Resource - terraform-provider	Dynamic Secrets	Create and manage AWS IAM Dynamic Secret

kms_dynamic_secret_aws_iam (Resource)

Create and manage AWS IAM Dynamic Secret

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_dynamic_secret_aws_iam" "aws-iam" {
  name             = "aws-iam-dynamic-secret-example"
  project_slug     = "your-project-slug"
  environment_slug = "dev"
  path             = "/"
  default_ttl      = "2h"
  max_ttl          = "4h"

  configuration = {
    method = "access_key"

    # This block is used if 'method' is set to "access_key"
    access_key_config = {
      access_key        = "YOUR_AWS_ACCESS_KEY_ID"
      secret_access_key = "YOUR_AWS_SECRET_ACCESS_KEY"
    }

    # This block is used if 'method' is set to "assume_role"
    # assume_role_config = {
    #   role_arn = "arn:aws:iam::123456789012:role/YourAssumeRole"
    # }

    region = "us-east-1"

    aws_path                       = "/"
    permission_boundary_policy_arn = "arn:aws:iam::123456789012:policy/YourBoundaryPolicy"
    policy_document                = <<-EOT
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "s3:ListBucket",
          "Resource": "*"
        }
      ]
    }
    EOT
    user_groups                    = "group-a,group-b"
    policy_arns                    = "arn:aws:iam::aws:policy/ReadOnlyAccess,arn:aws:iam::123456789012:policy/SpecificPolicy"
  }

  username_template = "{{randomUsername}}"
}

Schema

Required

• configuration (Attributes) The configuration of the dynamic secret (see below for nested schema)
• default_ttl (String) The default TTL that will be applied for all the leases.
• environment_slug (String) The slug of the environment to create the dynamic secret in.
• name (String) The name of the dynamic secret.
• path (String) The path to create the dynamic secret in.
• project_slug (String) The slug of the project to create dynamic secret in.

Optional

• max_ttl (String) The maximum limit a TTL can be leased or renewed for.
• metadata (Attributes Set) The metadata associated with this dynamic secret (see below for nested schema)
• username_template (String) The username template of the dynamic secret

Read-Only

• id (String) The ID of the dynamic secret.

Nested Schema for configuration

Required:

• method (String) The authentication method to use. Must be 'access_key' or 'assume_role'.
• region (String) The AWS data center region.

Optional:

• access_key_config (Attributes) Configuration for the 'access_key' authentication method. (see below for nested schema)
• assume_role_config (Attributes) Configuration for the 'assume_role' authentication method. (see below for nested schema)
• aws_path (String) IAM AWS Path to scope created IAM User resource access.
• permission_boundary_policy_arn (String) The IAM Policy ARN of the AWS Permissions Boundary to attach to IAM users created in the role.
• policy_arns (String) The AWS IAM managed policies that should be attached to the created users. Multiple values can be provided by separating them with commas
• policy_document (String) The AWS IAM inline policy that should be attached to the created users. Multiple values can be provided by separating them with commas
• user_groups (String) The AWS IAM groups that should be assigned to the created users. Multiple values can be provided by separating them with commas

Nested Schema for configuration.access_key_config

Required:

• access_key (String) The managing AWS IAM User Access Key
• secret_access_key (String, Sensitive) The managing AWS IAM User Secret Key

Nested Schema for configuration.assume_role_config

Required:

• role_arn (String) The ARN of the AWS Role to assume.

Nested Schema for metadata

Required:

• key (String) The key of the metadata object
• value (String) The value of the metadata object