terraform-provider-stackitprivatepreview/docs/guides/vault_secrets_manager.md

page_title
Using Vault Provider with STACKIT Secrets Manager

Using Vault Provider with STACKIT Secrets Manager

Overview

This guide outlines the process of utilizing the HashiCorp Vault provider alongside the STACKIT provider to write secrets in the STACKIT Secrets Manager. The guide focuses on secrets from STACKIT Cloud resources but can be adapted for any secret.

Steps

1. Configure STACKIT Provider

   provider "stackit" {
     default_region = "eu01"
   }
   

2. Create STACKIT Secrets Manager Instance

   resource "stackit_secretsmanager_instance" "example" {
     project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
     name       = "example-instance"
   }
   

3. Define STACKIT Secrets Manager User

   resource "stackit_secretsmanager_user" "example" {
     project_id    = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
     instance_id   = stackit_secretsmanager_instance.example.instance_id
     description   = "Example user"
     write_enabled = true
   }
   

4. Configure Vault Provider

   provider "vault" {
     address          = "https://prod.sm.eu01.stackit.cloud"
     skip_child_token = true
   
     auth_login_userpass {
       username = stackit_secretsmanager_user.example.username
       password = stackit_secretsmanager_user.example.password
     }
   }
   

5. Define Terraform Resource (Example: Observability Monitoring Instance)

   resource "stackit_observability_instance" "example" {
    project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    name       = "example-instance"
    plan_name  = "Observability-Monitoring-Medium-EU01"
   }
   

6. Store Secret in Vault

   resource "vault_kv_secret_v2" "example" {
     mount               = stackit_secretsmanager_instance.example.instance_id
     name                = "my-secret"
     cas                 = 1
     delete_all_versions = true
     data_json = jsonencode(
       {
        grafana_password = stackit_observability_instance.example.grafana_initial_admin_password,
        other_secret = ...,
       }
     )
   }
   

Note

This example can be adapted for various resources within the provider as well as any other Secret the user wants to set in the Secrets Manager instance. Adapting this examples means replacing the Observability Monitoring Grafana password with the appropriate value.