terraform-provider/docs/resources/secret_rotation_ldap_password.md

page_title, subcategory, description

page_title	subcategory	description
kms_secret_rotation_ldap_password Resource - terraform-provider	Secret Rotations	Create and manage LDAP Password Secret Rotations

kms_secret_rotation_ldap_password (Resource)

Create and manage LDAP Password Secret Rotations

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_secret_rotation_ldap_password" "example" {
  name          = "ldap-password-rotation"
  description   = "Rotation for LDAP user passwords"
  project_id    = "<project-id>"
  environment   = "<environment-slug>"
  secret_path   = "<secret-path>" # Root folder is /
  connection_id = "<app-connection-id>"

  auto_rotation_enabled = true
  rotation_interval     = 30 # days

  rotate_at_utc = {
    hours   = 2
    minutes = 0
  }

  parameters = {
    dn = "CN=John,OU=Users,DC=example,DC=com"

    password_requirements = {
      length = 48

      required = {
        digits    = 1
        lowercase = 1
        uppercase = 1
        symbols   = 0
      }

      allowed_symbols = "-_.~!*"
    }

    rotation_method = "connection-principal" # or "target-principal" depending on your LDAP setup
  }

  secrets_mapping = {
    dn       = "LDAP_DN"
    password = "LDAP_PASSWORD"
  }

  # Required when parameters.rotation_method is "target-principal"
  # temporary_parameters = {
  #   password = "<temporary-password-for-target>"
  # }
}

Schema

Required

• connection_id (String) The ID of the connection to use for the secret rotation.
• environment (String) The slug of the project environment to rotate secrets from.
• name (String) The name of the secret rotation.
• parameters (Attributes) Parameters to modify how secrets are rotated. (see below for nested schema)
• project_id (String) The ID of the Hanzo KMS project to create the secret rotation in.
• secret_path (String) The folder path to rotate secrets from.
• secrets_mapping (Attributes) Secret mappings to modify how secrets are rotated. (see below for nested schema)

Optional

• auto_rotation_enabled (Boolean) Whether secrets should be automatically rotated.
• description (String) The description of the secret rotation.
• rotate_at_utc (Attributes) At which UTC time the rotation should occur. (see below for nested schema)
• rotation_interval (Number) How many days to wait between each rotation.
• temporary_parameters (Attributes) Temporary parameters to modify how secrets are rotated. (see below for nested schema)

Read-Only

• id (String) The ID of the secret rotation.

Nested Schema for parameters

Required:

• dn (String) The Distinguished Name (DN) of the LDAP entry to rotate the password for.
• password_requirements (Attributes) Password generation requirements. (see below for nested schema)

Optional:

• rotation_method (String) The method to use for rotating the password. Supported options: connection-principal and target-principal (default: connection-principal)

Nested Schema for parameters.password_requirements

Required:

• length (Number) The length of the generated password.
• required (Attributes) Required character types in the generated password. (see below for nested schema)

Optional:

• allowed_symbols (String) String of allowed symbols for password generation.

Nested Schema for parameters.password_requirements.required

Required:

• digits (Number) Minimum number of digits required in the password.
• lowercase (Number) Minimum number of lowercase letters required in the password.
• symbols (Number) Minimum number of symbols required in the password.
• uppercase (Number) Minimum number of uppercase letters required in the password.

Nested Schema for secrets_mapping

Required:

• dn (String) The name of the secret that the Distinguished Name will be mapped to.
• password (String) The name of the secret that the generated password will be mapped to.

Nested Schema for rotate_at_utc

Optional:

• hours (Number) The hour at which the rotation should occur (UTC).
• minutes (Number) The minute at which the rotation should occur (UTC).

Nested Schema for temporary_parameters

Optional:

• password (String) The password of the provided principal if 'parameters.rotation_method' is set to 'target-principal'.