Adding Entities to Vault Namespaces,Groups, or Policies Terraform

Question

I'm having an issue with the Vault Terraform. I am able to create Entities, Namespaces, Groups, and policies but linking them together is not happening for me. I can get the policy added to the group just fine, but adding members to that group I cannot.

Here's what I have so far:

# module.users returns vault_identity_entity.entity.id
data "vault_identity_entity" "user_lookup" {
  for_each    = toset([for user in local.groups : user.name])
  entity_name = each.key

  depends_on = [
    module.users
  ]
}

# module.devops_namespace returns vault_namespace.namespace.path
resource "vault_identity_group" "devops" {
  depends_on = [
    vault_policy.policy
  ]
  name = "devops_users"
  namespace         = module.devops_namespace.vault_namespace
  member_entity_ids = [for user in data.vault_identity_entity.user_lookup : jsondecode(user.data_json).id]
}

resource "vault_identity_group_policies" "default" {
  policies = [vault_policy.gitlab_policy.name]
  exclusive = false
  group_id = vault_identity_group.devops.id
}

What I need to do is create a namespace and add users and a policy to that namespace.

Any help would be appreciated, thanks!

Answer 1

resource "vault_policy" "namespace" {
  depends_on = [module.namespace]
  name       = "namespace"
  policy     = file("policies/namespace.hcl")
  namespace  = "devops"
}

resource "vault_identity_group" "devops" {
  depends_on = [
    module.users
  ]
  name              = "devops_users"
  namespace         = module.devops_namespace.vault_namespace
  policies          = [vault_policy.gitlab_policy.name]
  member_entity_ids = [for user in module.users : user.entity_id]
}

By referring the users the module created I was able to achieve the correct result.

Since the module created the users from locals and the data resource was trying to pull down the same users, the extra data resource section wasn't needed.

Thank you Marko E!