Skip to content

Commit 1b6880a

Browse files
jonathanfrappierjonathanfrappier
authored
Merge branch 'main' into RADAR-6812-adding-documentation-for-aws-secrets-manager-indexing
2 parents 832a234 + 676adc2 commit 1b6880a

File tree

10 files changed

+356
-240
lines changed

10 files changed

+356
-240
lines changed

‎content/terraform-docs-common/docs/cloud-docs/api-docs/state-versions.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ Some of the information returned in a state version API object might be **popula
4949
| `billable-rum-count` | Count of billable Resources Under Management (RUM). Only present for organization members on HCP Terraform RUM plans with visibility of billable RUM usage. |
5050
| `hosted-json-state-download-url` | A URL from which you can download the state data in a [stable format](/terraform/internals/json-format) appropriate for external integrations to consume. Only available if the state was created by Terraform 1.3+. |
5151
| `hosted-state-download-url` | A URL from which you can download the raw state data, in the format used internally by Terraform. |
52-
| `sanitized-state-download-url` | A URL to which you can download state data with sensitive values redacted. |
52+
| `sanitized-state-download-url` | A URL to which you can download state data with sensitive values redacted. This URL is only available for workspaces using [hold your own key](/terraform/cloud-docs/hold-your-own-key) encryption. |
5353
| `hosted-json-state-upload-url` | A URL to which you can upload state data in a [stable format](/terraform/internals/json-format) appropriate for external integrations to consume. You can upload JSON state content once per state version. |
5454
| `hosted-state-upload-url` | A URL to which you can upload state data in the format used Terraform uses internally. You can upload state data once per state version. |
5555
| `hyok-encrypted-data-key` | A reference to the HYOK encrypted data key used to secure this state version. Hold your own key is only available in HCP Terraform, [learn more](/terraform/cloud-docs/hold-your-own-key). |

‎content/terraform/v1.13.x/docs/language/resources/index.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,4 +42,4 @@ As your infrastructure needs change, you may want to add or remove resources fro
4242
- [Remove a resource from state](/terraform/language/state/remove) describes how to remove a resource from state without destroying the actual infrastructure object.
4343
- [Destroy a resource](/terraform/language/resources/destroy) describes how to remove a resource from state and destroy the actual infrastructure.
4444

45-
Many providers also allow you to read data from the provider so that you can use data from exisitng infrastructure without provisioning actual infrastructure objects. Refer to [Query data sources](/terraform/language/data-sources) for more information.
45+
Many providers also allow you to read data from the provider so that you can use data from existing infrastructure without provisioning actual infrastructure objects. Refer to [Query data sources](/terraform/language/data-sources) for more information.

‎content/vault/v1.16.x/content/api-docs/system/storage/raftautosnapshots.mdx‎

Lines changed: 37 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,12 @@ environment variables or files on disk in predefined locations.
7171

7272
- `aws_s3_region` `(string: <required>)` - AWS region bucket is in.
7373

74-
- `aws_access_key_id` `(string)` - AWS access key ID.
74+
- `aws_access_key_id` `(string)` - AWS access key ID. The associated AWS account
75+
must have the following permissions in S3 so that Vault can store and manage
76+
the snapshots:
77+
- `s3:ListBucket`
78+
- `s3:PutObject`
79+
- `s3:DeleteObject`
7580

7681
- `aws_secret_access_key` `(string)` - AWS secret access key.
7782

@@ -87,7 +92,11 @@ environment variables or files on disk in predefined locations.
8792
- `aws_s3_force_path_style` `(boolean)` - Use the endpoint/bucket URL style
8893
instead of bucket.endpoint. May be needed when setting `aws_s3_endpoint`.
8994

90-
- `aws_s3_enable_kms` `(boolean)` - Use KMS to encrypt bucket contents.
95+
- `aws_s3_enable_kms` `(boolean)` - Use KMS to encrypt bucket contents. To use
96+
KMS encryption, the associated AWS account must have the following
97+
permissions:
98+
- `kms:Decrypt`
99+
- `kms:GenerateDataKey`
91100

92101
- `aws_s3_server_side_encryption` `(boolean)` - Use AES256 to encrypt bucket contents. Cannot use with `aws_s3_enable_kms` parameter.
93102

@@ -98,23 +107,27 @@ environment variables or files on disk in predefined locations.
98107
- `google_gcs_bucket` `(string: <required>)` GCS bucket to write snapshots to.
99108

100109
- `google_service_account_key` `(string)` - Google service account key in JSON format. Depending
101-
on how the API is invoked, this may be need to be JSON-escaped, e.g. for newlines and double quotes.
110+
on how the API is invoked, this may need to be JSON-escaped, e.g. for newlines and double quotes.
102111
The raw value looks like this:
103-
104-
```json
105-
{
106-
"type": "service_account",
107-
"project_id": "project-id",
108-
"private_key_id": "key-id",
109-
"private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQ ... /WZs=\n-----END RSA PRIVATE KEY-----\n",
110-
"client_email": "service-account-email",
111-
"client_id": "client-id",
112-
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
113-
"token_uri": "https://accounts.google.com/o/oauth2/token",
114-
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
115-
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
116-
}
117-
```
112+
```json
113+
{
114+
"type": "service_account",
115+
"project_id": "project-id",
116+
"private_key_id": "key-id",
117+
"private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQ ... /WZs=\n-----END RSA PRIVATE KEY-----\n",
118+
"client_email": "service-account-email",
119+
"client_id": "client-id",
120+
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
121+
"token_uri": "https://accounts.google.com/o/oauth2/token",
122+
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
123+
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
124+
}
125+
```
126+
127+
The associated Google service account must have the following permissions in Google Cloud Storage so that Vault can store and manage the snapshots:
128+
- `storage.objects.create`
129+
- `storage.objects.list`
130+
- `storage.objects.delete`
118131

119132
- `google_endpoint` `(string)` - GCS endpoint. This is typically only set when
120133
using a non-Google GCS implementation like fake-gcs-server.
@@ -128,7 +141,12 @@ environment variables or files on disk in predefined locations.
128141
- `azure_container_name` `(string: <required>)` - Azure container name to write
129142
snapshots to.
130143

131-
- `azure_account_name` `(string)` - Azure account name.
144+
- `azure_account_name` `(string)` - Azure account name. The associated Azure
145+
account must have the following permissions in Azure Blob Storage so that
146+
Vault can store and manage the snapshots:
147+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read`
148+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write`
149+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete`
132150

133151
- `azure_account_key` `(string)` - Azure account key.
134152

‎content/vault/v1.19.x/content/api-docs/system/storage/raftautosnapshots.mdx‎

Lines changed: 37 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,12 @@ parameters in the context of AWS EKS & S3 configuration.
8181

8282
- `aws_s3_region` `(string: <required>)` - AWS region bucket is in.
8383

84-
- `aws_access_key_id` `(string)` - AWS access key ID.
84+
- `aws_access_key_id` `(string)` - AWS access key ID. The associated AWS account
85+
must have the following permissions in S3 so that Vault can store and manage
86+
the snapshots:
87+
- `s3:ListBucket`
88+
- `s3:PutObject`
89+
- `s3:DeleteObject`
8590

8691
- `aws_secret_access_key` `(string)` - AWS secret access key.
8792

@@ -97,7 +102,10 @@ parameters in the context of AWS EKS & S3 configuration.
97102
- `aws_s3_force_path_style` `(boolean)` - Use the endpoint/bucket URL style
98103
instead of bucket.endpoint. May be needed when setting `aws_s3_endpoint`.
99104

100-
- `aws_s3_enable_kms` `(boolean)` - Use KMS to encrypt bucket contents.
105+
- `aws_s3_enable_kms` `(boolean)` - Use KMS to encrypt bucket contents. To use
106+
KMS encryption, the associated account must have the following permissions:
107+
- `kms:Decrypt`
108+
- `kms:GenerateDataKey`
101109

102110
- `aws_s3_server_side_encryption` `(boolean)` - Use AES256 to encrypt bucket contents. Cannot use with `aws_s3_enable_kms` parameter.
103111

@@ -108,23 +116,28 @@ parameters in the context of AWS EKS & S3 configuration.
108116
- `google_gcs_bucket` `(string: <required>)` GCS bucket to write snapshots to.
109117

110118
- `google_service_account_key` `(string)` - Google service account key in JSON format. Depending
111-
on how the API is invoked, this may be need to be JSON-escaped, e.g. for newlines and double quotes.
112-
The raw value looks like this:
119+
on how you invoke the API, you may need to JSON-escape the account key. For
120+
example, to include data with newlines and double quotes the raw value would
121+
look like:
122+
```json
123+
{
124+
"type": "service_account",
125+
"project_id": "project-id",
126+
"private_key_id": "key-id",
127+
"private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQ ... /WZs=\n-----END RSA PRIVATE KEY-----\n",
128+
"client_email": "service-account-email",
129+
"client_id": "client-id",
130+
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
131+
"token_uri": "https://accounts.google.com/o/oauth2/token",
132+
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
133+
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
134+
}
135+
```
113136

114-
```json
115-
{
116-
"type": "service_account",
117-
"project_id": "project-id",
118-
"private_key_id": "key-id",
119-
"private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQ ... /WZs=\n-----END RSA PRIVATE KEY-----\n",
120-
"client_email": "service-account-email",
121-
"client_id": "client-id",
122-
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
123-
"token_uri": "https://accounts.google.com/o/oauth2/token",
124-
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
125-
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
126-
}
127-
```
137+
The associated Google service account must have the following permissions in Google Cloud Storage so that Vault can store and manage the snapshots:
138+
- `storage.objects.create`
139+
- `storage.objects.list`
140+
- `storage.objects.delete`
128141

129142
- `google_endpoint` `(string)` - GCS endpoint. This is typically only set when
130143
using a non-Google GCS implementation like fake-gcs-server.
@@ -138,7 +151,12 @@ parameters in the context of AWS EKS & S3 configuration.
138151
- `azure_container_name` `(string: <required>)` - Azure container name to write
139152
snapshots to.
140153

141-
- `azure_account_name` `(string)` - Azure account name.
154+
- `azure_account_name` `(string)` - Azure account name. The associated Azure
155+
account must have the following permissions in Azure Blob Storage so that
156+
Vault can store and manage the snapshots:
157+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read`
158+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write`
159+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete`
142160

143161
- `azure_auth_mode` `(string)` - One of `shared`, `managed`, or `environment`. If `environment` is set, Azure authentication details are retrieved from the environment variables: `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_TENANT_ID`, `AZURE_SUBSCRIPTION_ID`.
144162

‎content/vault/v1.20.x/content/api-docs/system/storage/raftautosnapshots.mdx‎

Lines changed: 44 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,15 @@ parameters in the context of AWS EKS & S3 configuration.
8181

8282
- `aws_s3_region` `(string: <required>)` - AWS region bucket is in.
8383

84-
- `aws_access_key_id` `(string)` - AWS access key ID.
84+
- `aws_access_key_id` `(string)` - AWS access key ID. The associated AWS account
85+
must have the following permissions in S3 so that Vault can store and manage
86+
the snapshots:
87+
- `s3:ListBucket`
88+
- `s3:PutObject`
89+
- `s3:DeleteObject`
90+
91+
To load a snapshot with your configuration, the account also needs:
92+
- `s3:GetObject`
8593

8694
- `aws_secret_access_key` `(string)` - AWS secret access key.
8795

@@ -97,7 +105,10 @@ parameters in the context of AWS EKS & S3 configuration.
97105
- `aws_s3_force_path_style` `(boolean)` - Use the endpoint/bucket URL style
98106
instead of bucket.endpoint. May be needed when setting `aws_s3_endpoint`.
99107

100-
- `aws_s3_enable_kms` `(boolean)` - Use KMS to encrypt bucket contents.
108+
- `aws_s3_enable_kms` `(boolean)` - Use KMS to encrypt bucket contents. To use
109+
KMS encryption, the associated AWS account must have the following permissions:
110+
- `kms:Decrypt`
111+
- `kms:GenerateDataKey`
101112

102113
- `aws_s3_server_side_encryption` `(boolean)` - Use AES256 to encrypt bucket contents. Cannot use with `aws_s3_enable_kms` parameter.
103114

@@ -108,23 +119,32 @@ parameters in the context of AWS EKS & S3 configuration.
108119
- `google_gcs_bucket` `(string: <required>)` GCS bucket to write snapshots to.
109120

110121
- `google_service_account_key` `(string)` - Google service account key in JSON format. Depending
111-
on how the API is invoked, this may be need to be JSON-escaped, e.g. for newlines and double quotes.
112-
The raw value looks like this:
122+
on how you invoke the API, you may need to JSON-escape the account key. For
123+
example, to include data with newlines and double quotes the raw value would
124+
look like:
125+
```json
126+
{
127+
"type": "service_account",
128+
"project_id": "project-id",
129+
"private_key_id": "key-id",
130+
"private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQ ... /WZs=\n-----END RSA PRIVATE KEY-----\n",
131+
"client_email": "service-account-email",
132+
"client_id": "client-id",
133+
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
134+
"token_uri": "https://accounts.google.com/o/oauth2/token",
135+
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
136+
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
137+
}
138+
```
113139

114-
```json
115-
{
116-
"type": "service_account",
117-
"project_id": "project-id",
118-
"private_key_id": "key-id",
119-
"private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQ ... /WZs=\n-----END RSA PRIVATE KEY-----\n",
120-
"client_email": "service-account-email",
121-
"client_id": "client-id",
122-
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
123-
"token_uri": "https://accounts.google.com/o/oauth2/token",
124-
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
125-
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
126-
}
127-
```
140+
The associated Google service account must have following permissions in
141+
Google Cloud Storage so that Vault can store and manage the snapshots:
142+
- `storage.objects.create`
143+
- `storage.objects.list`
144+
- `storage.objects.delete`
145+
146+
To load a snapshot with your configuration, the account also needs:
147+
- `storage.objects.get`
128148

129149
- `google_endpoint` `(string)` - GCS endpoint. This is typically only set when
130150
using a non-Google GCS implementation like fake-gcs-server.
@@ -138,7 +158,12 @@ parameters in the context of AWS EKS & S3 configuration.
138158
- `azure_container_name` `(string: <required>)` - Azure container name to write
139159
snapshots to.
140160

141-
- `azure_account_name` `(string)` - Azure account name.
161+
- `azure_account_name` `(string)` - Azure account name. The associated Azure
162+
account must have the following permissions in Azure Blob Storage so that
163+
Vault can store and manage the snapshots:
164+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read`
165+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write`
166+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete`
142167

143168
- `azure_auth_mode` `(string)` - One of `shared`, `managed`, or `environment`. If `environment` is set, Azure authentication details are retrieved from the environment variables: `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_TENANT_ID`, `AZURE_SUBSCRIPTION_ID`.
144169

‎content/vault/v1.20.x/content/docs/sysadmin/snapshots/index.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ Step-by-step instructions:
3333
- [Restore a snapshot](/vault/docs/sysadmin/snapshots/restore)
3434
- [Recover discrete secrets in a replicated environment](/vault/docs/sysadmin/snapshots/recover-a-secret/replicated-cluster) <EnterpriseAlert inline="true" />
3535
- [Recover discrete secrets in a non-replicated environment](/vault/docs/sysadmin/snapshots/recover-a-secret/single-cluster) <EnterpriseAlert inline="true" />
36-
- [Automate snapshots](/vault/docs/sysadmin/snapshots/recover-a-secret) <EnterpriseAlert inline="true" />
36+
- [Automate snapshots](/vault/docs/sysadmin/snapshots/automate) <EnterpriseAlert inline="true" />
3737
- [Recover discrete secrets](/vault/docs/sysadmin/snapshots/recover-a-secret) <EnterpriseAlert inline="true" />
3838

3939
</Tab>
@@ -59,4 +59,4 @@ Detailed tutorials:
5959

6060
</Tab>
6161

62-
</Tabs>
62+
</Tabs>

0 commit comments

Comments
 (0)