Documentation

hashivault_aws_ec2_role_create - Hashicorp Vault aws ec2 create role module

New in version 3.9.8.

Synopsis

  • Module to create a aws ec2 backed vault role

Parameters

Parameter Choices/Defaults Comments
allow_instance_migration
if set to true, allows migration of the underlying instance where the client resides.
auth_type
auth type permitted for this role. Valid choices are ec2 and iam
authtype Default:
token
authentication type to use: token, userpass, github, ldap, approle
bound_account_id
defines a constraint on the EC2 instances that can perform the login operation that they should be using the account ID
bound_ami_id
defines a constraint on the EC2 instances that can perform the login operation that they should be using the AMI ID specified
bound_iam_instance_profile_arn
defines a constraint on the EC2 instances that can perform the login operation that they must be associated with an IAM instance profile
bound_iam_role_arn
defines a constraint on the EC2 instances that can perform the login operation that they must match the IAM role ARN
bound_subnet_id
defines a constraint on the EC2 instances that can perform the login operation that they be associated with the subnet ID
bound_vpc_id
defines a constraint on the EC2 instances that can perform the login operation that they be associated with the VPC ID that matches the value
ca_cert Default:
to environment variable VAULT_CACERT
path to a PEM-encoded CA cert file to use to verify the Vault server TLS certificate
ca_path Default:
to environment variable VAULT_CAPATH
path to a directory of PEM-encoded CA cert files to verify the Vault server TLS certificate : if ca_cert is specified, its value will take precedence
client_cert Default:
to environment variable VAULT_CLIENT_CERT
path to a PEM-encoded client certificate for TLS authentication to the Vault server
client_key Default:
to environment variable VAULT_CLIENT_KEY
path to an unencrypted PEM-encoded private key matching the client certificate
disallow_reauthentication
If set to true, only allows a single token to be granted per instance ID.
inferred_entity_type
Instructs Vault to turn on inferencing. The only valid value is ec2_instance
name
role name.
password Default:
to environment variable VAULT_PASSWORD
password to login to vault.
policies
policies for the role.
resolve_aws_unique_ids
If set to true, the bound_iam_principal_arn is resolved to an AWS Unique ID for the bound principal ARN.
token Default:
to environment variable VAULT_TOKEN
token for vault
token_max_ttl
The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds
token_ttl
The TTL period of tokens issued using this role, provided as a number of seconds
url Default:
to environment variable VAULT_ADDR
url for vault
username Default:
to environment variable VAULT_USER
username to login to vault.
verify Default:
to environment variable VAULT_SKIP_VERIFY
if set, do not verify presented TLS certificate before communicating with Vault server : setting this variable is not recommended except during testing

Examples

---
- hosts: localhost
  tasks:
    - hashivault_aws_ec2_role_create:
        name: myrole
        auth_type: iam
        inferred_entity_type: ec2_instance
        inferred_aws_region: eu-west-1
        bound_iam_role_arn: arn:aws:iam::12345678:root/ec2-role

Status

Author

  • UNKNOWN

Hint

If you notice any issues in this documentation you can edit this document to improve it.