Vault - Assign multiple aliases for one identity group

Question

I've been trying to assign multiple group aliases, meaning, multiple AD groups in our company, into one identity group. So far we've had an identity group for each alias, and we realized that doesn't make sense, as they all carry the same policies.

We are using Terraform in order to maintain and provision our infrastructure.

This is my expected form:

resource "vault_identity_group" "saas-mfi" {
            metadata = {
              productname = "mfi"
            }
            name = "saas-mfi"
            policies = [
              "eaas-key",
              "secret-store-mfi"
            ]
            type = "external"
}

resource "vault_identity_group_alias" "alias_1" {
            canonical_id = vault_identity_group.saas-mfi.id
            mount_accessor = var.org_local_mount_accessor
            name = "alias_1"
}

resource "vault_identity_group_alias" "alias_2" {
            canonical_id = vault_identity_group.saas-mfi.id
            mount_accessor = var.org_local_mount_accessor
            name = "alias_2"
}

resource "vault_identity_group_alias" "alias_3" {
            canonical_id = vault_identity_group.saas-mfi.id
            mount_accessor = var.org_local_mount_accessor
            name = "alias_3"
}

When I try to apply this configuration, I get the following error:

Error: Provider produced inconsistent result after apply

Of course, the issue does not stand with the provider. But it seems like one identity group can't have more than one alias to itself. Which is weird, as in the UI, there is a tab for identity groups called "Aliases", in plural.

If anybody has any information regarding this matter, I would really appreciate that.

Answer 1

I was trying to do the same thing but just came across the following paragraph in the documentation for identity:

External group serves as a mapping to a group that is outside of the identity store. External groups can have one (and only one) alias. This alias should map to a notion of group that is outside of the identity store.

From the section on External vs Internal Groups.