add rotate-on-read option on ldap secrets

Author: Vivek Pandey

internal/consts/consts.go

@@ -864,6 +864,8 @@ const (
 	FieldAzureClientID             = "azure_client_id"
 	FieldAzureAuthMode             = "azure_auth_mode"
 	FieldSelfManaged               = "self_managed"
+	FieldRotateOnRead              = "rotate_on_read"
+	FieldRotateOnReadCooldown      = "rotate_on_read_cooldown"
 	FieldRotationPolicy            = "rotation_policy"
 	FieldAWSSecretAccessKeyWO      = "aws_secret_access_key_wo"
 	FieldSecretsWOVersion          = "secrets_wo_version"

vault/resource_ldap_secret_backend.go

@@ -150,6 +150,18 @@ func ldapSecretBackendResource() *schema.Resource {
 			ConflictsWith: []string{consts.FieldBindPass, consts.FieldBindPassWO},
 			ExactlyOneOf:  []string{consts.FieldBindPass, consts.FieldBindPassWO, consts.FieldSelfManaged},
 		},
+		consts.FieldRotateOnRead: {
+			Type:        schema.TypeBool,
+			Optional:    true,
+			Computed:    true,
+			Description: "If true, static role credentials are rotated on each read. Acts as a default for all static roles. Requires Vault Enterprise ≥ 2.1.0.",
+		},
+		consts.FieldRotateOnReadCooldown: {
+			Type:        schema.TypeInt,
+			Optional:    true,
+			Computed:    true,
+			Description: "Minimum seconds between rotate-on-read rotations. Acts as a default cooldown for all static roles. Requires Vault Enterprise ≥ 2.1.0.",
+		},
 	}
 	resource := provider.MustAddMountMigrationSchema(&schema.Resource{
 		CreateContext: provider.MountCreateContextWrapper(createUpdateLDAPConfigResource, provider.VaultVersion112),
@@ -258,6 +270,16 @@ func createUpdateLDAPConfigResource(ctx context.Context, d *schema.ResourceData,
 		automatedrotationutil.ParseAutomatedRotationFields(d, data)
 	}
 
+	// get rotate-on-read fields
+	if provider.IsAPISupported(meta, provider.VaultVersion210) && provider.IsEnterpriseSupported(meta) {
+		if v, ok := d.GetOk(consts.FieldRotateOnRead); ok {
+			data[consts.FieldRotateOnRead] = v
+		}
+		if v, ok := d.GetOk(consts.FieldRotateOnReadCooldown); ok {
+			data[consts.FieldRotateOnReadCooldown] = v
+		}
+	}
+
 	// get self-managed boolean
 	if provider.IsAPISupported(meta, provider.VaultVersion200) && provider.IsEnterpriseSupported(meta) {
 		if d.HasChange(consts.FieldSelfManaged) {
@@ -348,6 +370,19 @@ func readLDAPConfigResource(ctx context.Context, d *schema.ResourceData, meta in
 		}
 	}
 
+	if provider.IsAPISupported(meta, provider.VaultVersion210) && provider.IsEnterpriseSupported(meta) {
+		if v, ok := resp.Data[consts.FieldRotateOnRead]; ok {
+			if err := d.Set(consts.FieldRotateOnRead, v); err != nil {
+				return diag.Errorf("error setting %s: %s", consts.FieldRotateOnRead, err)
+			}
+		}
+		if v, ok := resp.Data[consts.FieldRotateOnReadCooldown]; ok {
+			if err := d.Set(consts.FieldRotateOnReadCooldown, v); err != nil {
+				return diag.Errorf("error setting %s: %s", consts.FieldRotateOnReadCooldown, err)
+			}
+		}
+	}
+
 	return nil
 }
 

vault/resource_ldap_secret_backend_static_role.go

@@ -67,6 +67,16 @@ func ldapSecretBackendStaticRoleResource() *schema.Resource {
 			Optional:    true,
 			Description: "Name of the password policy to use to generate passwords for this role.",
 		},
+		consts.FieldRotateOnRead: {
+			Type:        schema.TypeBool,
+			Optional:    true,
+			Description: "If true, credentials are rotated on each read. Overrides the engine-level default when set. Requires Vault Enterprise ≥ 2.1.0.",
+		},
+		consts.FieldRotateOnReadCooldown: {
+			Type:        schema.TypeInt,
+			Optional:    true,
+			Description: "Minimum seconds between rotate-on-read rotations for this role. Overrides the engine-level default when set. Requires Vault Enterprise ≥ 2.1.0.",
+		},
 	}
 	resource := &schema.Resource{
 		CreateContext: createUpdateLDAPStaticRoleResource,
@@ -141,6 +151,16 @@ func createUpdateLDAPStaticRoleResource(ctx context.Context, d *schema.ResourceD
 		}
 	}
 
+	// get rotate-on-read role-level overrides
+	if provider.IsAPISupported(meta, provider.VaultVersion210) && provider.IsEnterpriseSupported(meta) {
+		if v, ok := d.GetOk(consts.FieldRotateOnRead); ok {
+			data[consts.FieldRotateOnRead] = v
+		}
+		if v, ok := d.GetOk(consts.FieldRotateOnReadCooldown); ok {
+			data[consts.FieldRotateOnReadCooldown] = v
+		}
+	}
+
 	if _, err := client.Logical().WriteWithContext(ctx, rolePath, data); err != nil {
 		return diag.FromErr(fmt.Errorf("error writing %q: %s", rolePath, err))
 	}
@@ -187,6 +207,20 @@ func readLDAPStaticRoleResource(ctx context.Context, d *schema.ResourceData, met
 		}
 	}
 
+	// read rotate-on-read role-level overrides (only present when explicitly set on the role)
+	if provider.IsAPISupported(meta, provider.VaultVersion210) && provider.IsEnterpriseSupported(meta) {
+		if v, ok := resp.Data[consts.FieldRotateOnRead]; ok {
+			if err := d.Set(consts.FieldRotateOnRead, v); err != nil {
+				return diag.Errorf("error setting %s: %s", consts.FieldRotateOnRead, err)
+			}
+		}
+		if v, ok := resp.Data[consts.FieldRotateOnReadCooldown]; ok {
+			if err := d.Set(consts.FieldRotateOnReadCooldown, v); err != nil {
+				return diag.Errorf("error setting %s: %s", consts.FieldRotateOnReadCooldown, err)
+			}
+		}
+	}
+
 	return nil
 }
 

vault/resource_ldap_secret_backend_static_role_test.go

@@ -278,3 +278,64 @@ resource "vault_ldap_secret_backend_static_role" "role" {
 }
 `, passwordPolicy, mount, bindDN, bindPass, url, username, dn, role, rotationPeriod)
 }
+
+func TestAccLDAPSecretBackendStaticRole_RotateOnRead(t *testing.T) {
+	path := acctest.RandomWithPrefix("tf-test-ldap-static-role")
+	bindDN, bindPass, url := testutil.GetTestLDAPCreds(t)
+	resourceType := "vault_ldap_secret_backend_static_role"
+	resourceName := resourceType + ".role"
+	username := "alice"
+	dn := "cn=alice,ou=users,dc=example,dc=org"
+
+	resource.Test(t, resource.TestCase{
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck: func() {
+			acctestutil.TestEntPreCheck(t)
+			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion210)
+		},
+		CheckDestroy: testCheckMountDestroyed(resourceType, consts.MountTypeLDAP, consts.FieldMount),
+		Steps: []resource.TestStep{
+			{
+				Config: testLDAPSecretBackendStaticRoleConfig_rotateOnRead(path, bindDN, bindPass, url, username, dn, "true", "60"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, consts.FieldUsername, username),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldDN, dn),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldRotateOnRead, "true"),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldRotateOnReadCooldown, "60"),
+				),
+			},
+			{
+				Config: testLDAPSecretBackendStaticRoleConfig_rotateOnRead(path, bindDN, bindPass, url, username, dn, "true", "120"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, consts.FieldRotateOnRead, "true"),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldRotateOnReadCooldown, "120"),
+				),
+			},
+			testutil.GetImportTestStep(resourceName, false, nil,
+				consts.FieldMount, consts.FieldRoleName, consts.FieldSkipImportRotation),
+		},
+	})
+}
+
+func testLDAPSecretBackendStaticRoleConfig_rotateOnRead(mount, bindDN, bindPass, url, username, dn, rotateOnRead, cooldown string) string {
+	return fmt.Sprintf(`
+resource "vault_ldap_secret_backend" "test" {
+  path     = "%s"
+  binddn   = "%s"
+  bindpass = "%s"
+  url      = "%s"
+  userdn   = "CN=Users,DC=corp,DC=example,DC=net"
+}
+
+resource "vault_ldap_secret_backend_static_role" "role" {
+  mount                    = vault_ldap_secret_backend.test.path
+  username                 = "%s"
+  dn                       = "%s"
+  role_name                = "%s"
+  rotation_period          = 60
+  rotate_on_read           = %s
+  rotate_on_read_cooldown  = %s
+  skip_import_rotation     = true
+}
+`, mount, bindDN, bindPass, url, username, dn, username, rotateOnRead, cooldown)
+}

vault/resource_ldap_secret_backend_test.go

@@ -487,3 +487,53 @@ resource "vault_ldap_secret_backend" "test" {
   bindpass_wo_version  = 1
 }`, path)
 }
+
+func TestLDAPSecretBackend_RotateOnRead(t *testing.T) {
+	var (
+		path         = acctest.RandomWithPrefix("tf-test-ldap")
+		bindDN       = "test-bind-dn"
+		resourceType = "vault_ldap_secret_backend"
+		resourceName = resourceType + ".test"
+	)
+	resource.Test(t, resource.TestCase{
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck: func() {
+			acctestutil.TestEntPreCheck(t)
+			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion210)
+		},
+		PreventPostDestroyRefresh: true,
+		CheckDestroy:              testCheckMountDestroyed(resourceType, consts.MountTypeLDAP, consts.FieldPath),
+		Steps: []resource.TestStep{
+			{
+				Config: testLDAPSecretBackendConfig_rotateOnRead(path, bindDN, "true", "120"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, consts.FieldPath, path),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldBindDN, bindDN),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldRotateOnRead, "true"),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldRotateOnReadCooldown, "120"),
+				),
+			},
+			{
+				Config: testLDAPSecretBackendConfig_rotateOnRead(path, bindDN, "true", "240"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, consts.FieldRotateOnRead, "true"),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldRotateOnReadCooldown, "240"),
+				),
+			},
+			testutil.GetImportTestStep(resourceName, false, nil, consts.FieldDisableRemount),
+		},
+	})
+}
+
+func testLDAPSecretBackendConfig_rotateOnRead(path, bindDN, rotateOnRead, cooldown string) string {
+	return fmt.Sprintf(`
+resource "vault_ldap_secret_backend" "test" {
+  path                      = "%s"
+  description               = "test description"
+  binddn                    = "%s"
+  userdn                    = "CN=Users,DC=corp,DC=example,DC=net"
+  self_managed              = true
+  rotate_on_read            = %s
+  rotate_on_read_cooldown   = %s
+}`, path, bindDN, rotateOnRead, cooldown)
+}

website/docs/r/ldap_secret_backend.html.md

@@ -106,6 +106,13 @@ The following arguments are supported:
   using its current password (no privileged bind DN). Immutable after creation. Enforces `password`
   requirement when creating static roles. Requires Vault Enterprise 2.0+.
 
+* `rotate_on_read` - (Optional) If true, static role credentials are rotated on each read. Acts as
+  the default for all static roles that do not provide their own override. Requires Vault Enterprise 2.1.0+.
+
+* `rotate_on_read_cooldown` - (Optional) Minimum number of seconds between rotate-on-read rotations.
+  Acts as the default cooldown for all static roles that do not provide their own override.
+  Requires Vault Enterprise 2.1.0+.
+
 ### Common Mount Arguments
 These arguments are common across all resources that mount a secret engine.
 

website/docs/r/ldap_secret_backend_static_role.html.md

@@ -77,6 +77,17 @@ The following arguments are supported:
 * `password_policy` - (Optional) Name of the password policy to use to generate passwords for this role.
   Requires Vault 2.1.0+.
 
+* `rotate_on_read` - (Optional) If true, credentials are rotated on each read. When set, this overrides
+  the engine-level `rotate_on_read` default. When unset, the role inherits the engine-level value.
+  Removing this attribute after it has been set is not supported without recreating the role.
+  Requires Vault Enterprise 2.1.0+.
+
+* `rotate_on_read_cooldown` - (Optional) Minimum number of seconds between rotate-on-read rotations
+  for this role. When set, this overrides the engine-level `rotate_on_read_cooldown` default.
+  When unset, the role inherits the engine-level value.
+  Removing this attribute after it has been set is not supported without recreating the role.
+  Requires Vault Enterprise 2.1.0+.
+
 * `disable_automated_rotation` - (Optional) Cancels all upcoming rotations of the static credential until unset. Requires Vault Enterprise 2.0+.
 
 * `password_wo_version` - (Optional) The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).