Policy - orders-service
Grants read-only access to orders-service secrets and database credentials

KV v2 - read secrets
path "secret/data/orders-service/*" {
  capabilities = ["read"]
}

KV v2 - list secret names (metadata path for listing)
path "secret/metadata/orders-service/*" {
  capabilities = ["list"]
}

KV v2 - list the top-level directory
path "secret/metadata/orders-service" {
  capabilities = ["list"]
}

Dynamic database credentials (read-only, Vault generates these)
path "database/creds/orders-service-role" {
  capabilities = ["read"]
}

Allow the service to renew its own token
path "auth/token/renew-self" {
  capabilities = ["update"]
}

Allow the service to look up its own token info
path "auth/token/lookup-self" {
  capabilities = ["read"]
}

Terraform - enable AppRole auth and configure role

resource "vault_auth_backend" "approle" {
  type = "approle"
  path = "approle"
}

resource "vault_approle_auth_backend_role" "orders_service" {
  backend   = vault_auth_backend.approle.path
  role_name = "orders-service"

  token_policies         = ["orders-service"]
  token_ttl              = 86400    # 24 hours in seconds
  token_max_ttl          = 604800   # 7 days

  secret_id_ttl          = 86400   # Secret IDs expire after 24 hours
  secret_id_num_uses     = 0       # Unlimited uses (use 1 for one-time bootstrap)

  token_bound_cidrs      = ["10.0.0.0/8"]
  secret_id_bound_cidrs  = ["10.0.0.0/8"]
}

output "role_id" {
  value = vault_approle_auth_backend_role.orders_service.role_id
}

Terraform - Kubernetes auth backend role
resource "vault_kubernetes_auth_backend_role" "orders_service" {
  backend                          = "kubernetes"
  role_name                        = "orders-service"

  bound_service_account_names      = ["orders-service-sa"]
  bound_service_account_namespaces = ["production"]

  token_policies = ["orders-service"]
  token_ttl      = 3600    # 1 hour (short-lived; pods re-authenticate)
  token_max_ttl  = 86400
}

resource "vault_database_secret_backend_connection" "postgres" {
  backend       = "database"
  name          = "orders-postgres"
  allowed_roles = ["orders-service-role"]

  postgresql {
    connection_url = "postgresql://{{username}}:{{password}}@postgres.internal:5432/orders"
    max_open_connections = 5
    max_connection_lifetime = "300s"
  }

  root_rotation_statements = [
    "ALTER USER '{{name}}' WITH PASSWORD '{{password}}';"
  ]
}

resource "vault_database_secret_backend_role" "orders_service" {
  backend = "database"
  name    = "orders-service-role"
  db_name = vault_database_secret_backend_connection.postgres.name

  default_ttl = "3600"   # 1 hour
  max_ttl     = "86400"  # 24 hours max renewal

  creation_statements = [
    "CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';",
    "GRANT SELECT, INSERT, UPDATE ON ALL TABLES IN SCHEMA public TO \"{{name}}\";",
    "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE ON TABLES TO \"{{name}}\";"
  ]

  revocation_statements = [
    "REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM \"{{name}}\";",
    "DROP ROLE IF EXISTS \"{{name}}\";"
  ]
}

Enable database secrets engine
resource "vault_mount" "database" {
  path = "database"
  type = "database"
}

Configure Postgres connection
resource "vault_database_connection" "postgres" {
  backend       = vault_mount.database.path
  name          = "postgres"
  allowed_roles = ["orders-service-ro", "orders-service-rw"]

  postgresql {
    connection_url       = "postgresql://{{username}}:{{password}}@db.prod.internal:5432/orders"
    username             = "vault_admin"
    password             = var.postgres_admin_password
    verify_connection    = true
    disable_verify_connection = false
  }
}

Read-only role
resource "vault_database_secret_backend_role" "orders_ro" {
  backend             = vault_mount.database.path
  name                = "orders-service-ro"
  db_name             = vault_database_connection.postgres.name
  creation_statements = [
    "CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';",
    "GRANT CONNECT ON DATABASE orders TO \"{{name}}\";",
    "GRANT USAGE ON SCHEMA public TO \"{{name}}\";",
    "GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";"
  ]
  default_ttl = 3600  # 1 hour
  max_ttl     = 86400 # 24 hours
}

Read-write role
resource "vault_database_secret_backend_role" "orders_rw" {
  backend             = vault_mount.database.path
  name                = "orders-service-rw"
  db_name             = vault_database_connection.postgres.name
  creation_statements = [
    "CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';",
    "GRANT CONNECT ON DATABASE orders TO \"{{name}}\";",
    "GRANT USAGE ON SCHEMA public TO \"{{name}}\";",
    "GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO \"{{name}}\";"
  ]
  default_ttl = 3600
  max_ttl     = 86400
}

Policy - orders-service-db-access
path "database/creds/orders-service-ro" {
  capabilities = ["read"]
}

path "database/creds/orders-service-rw" {
  capabilities = ["read"]
}

path "auth/token/renew-self" {
  capabilities = ["update"]
}

Enable SSH secrets engine
resource "vault_mount" "ssh" {
  path = "ssh"
  type = "ssh"
}

Configure SSH CA
resource "vault_ssh_secret_backend_ca" "ca" {
  backend = vault_mount.ssh.path
  # Vault generates the CA keypair; store pub key in authorized_keys on servers
  generate_signing_key = true
}

SSH role for user certificates (8-hour TTL)
resource "vault_ssh_secret_backend_role" "user_cert" {
  backend = vault_mount.ssh.path
  name    = "user-cert"

  ttl                      = 28800  # 8 hours
  max_ttl                  = 28800
  allowed_user_key_config  = "dictated"
  allow_user_certificates  = true

  # Signed certificates can access these principals
  allowed_users = "ubuntu,ec2-user,ubuntu"

  # Optional: restrict to specific hosts by CIDR or hostname pattern
  allowed_domains = "prod-*.internal,staging-*.internal"
}

Output CA public key to distribute to servers
output "ssh_ca_public_key" {
  value     = vault_ssh_secret_backend_ca.ca.public_key
  sensitive = true
}

path "ssh/sign/user-cert" {
  capabilities = ["create", "update"]
}

path "auth/token/lookup-self" {
  capabilities = ["read"]
}