IaC Bazaar
Browse modules
Menu
Multi-cloud & platform-agnosticPlan-validated

Vault Policies & Auth

Vault policies, auth backends, and secret engine configuration as code.

terraformSecurity & Secretsmulti

Compare Secrets & Key Management across clouds →

vault-policiesvizier v1.2.0

Verification

Plan-validated

Passed: module logic verified on a mocked plan - inputs, validation rules, conditional creation and outputs resolve (no real provider, no cloud).

Conformance

  • Static validation (fmt · validate · tflint)
  • No applicable security policies for this provider
  • Plan tests (mocked: validation rules · outputs)

Provenance

Functional

  • Live test pending (no cloud run yet)

Last verified 2026-06-28 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o vault-policies-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/vault-policies/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle vault-policies-1.0.0.sigstore.json \
  vault-policies-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "08c0a9a5a38c6ebe33e8dabe47e47634b82fa52337f93ed90c7fa5625a0af56c  vault-policies-1.0.0.tar.gz" | sha256sum -c
Signature bundlePublic keyMachine-readable receiptHow we verify

Use it from the registry

terraform · opentofu
module "policies" {
  source  = "www.iac-bazaar.com/iac-bazaar/vault-policies/multi"
  version = "1.0.0"
}

Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.

Cite it in your README

badge · attribution

Paste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads plan-validated because the record says so, and the link lands on this page.

README.md, GitLab, Gitea
[![IaC Bazaar: plan-validated](https://www.iac-bazaar.com/api/artifacts/vault-policies/badge)](https://www.iac-bazaar.com/catalog/vault-policies?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

Terraform module 1.0.0, plan-validated on IaC Bazaar: [Vault Policies & Auth](https://www.iac-bazaar.com/catalog/vault-policies?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

```hcl
module "policies" {
  source  = "www.iac-bazaar.com/iac-bazaar/vault-policies/multi"
  version = "1.0.0"
}
```

Preview:IaC Bazaar: plan-validated

Inputs & outputs

Create a free account to read this module's contract

The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.

Create a free account →Sign in

Documentation

vault-policies

Status: static-validated, live-test pending. Ships under live-test quarantine — Vault provisioning is verified with fmt, validate, and tflint, but the apply → verify → destroy lane against a real Vault is not yet wired up (a local dev-mode Vault container is the planned live-test lane).

Vault policies, auth methods, and secret engines as code in one composable module. Works with Terraform and OpenTofu (>= 1.6), hashicorp/vault provider >= 5.0, < 6.0. Three maps — policies, auth_backends, secret_engines — describe a Vault tenant's Day-1 access surface, and a single module call brings it up against an already-running Vault (self-hosted or HCP Vault Dedicated).

Secure defaults

  • Deny-by-default by construction. Vault grants nothing unless a policy names a path, so a least-privilege posture is the natural one. The example policies scope each consumer to exactly one path prefix.
  • Auth methods stay unlisted. tune.listing_visibility defaults to hidden, so enabled methods are not advertised on the unauthenticated UI/CLI surface unless you explicitly opt into unauth.
  • No secrets in code. The module configures Vault structure only; it never writes secret material. Provider auth (VAULT_ADDR/VAULT_TOKEN) is supplied by the environment, never hardcoded.
  • Per-mount hardening available. seal_wrap, lease ceilings, and audit_non_hmac_* keys are exposed per secret engine for engines that store especially sensitive material.
  • Reserved names rejected. Policy names are validated against ^[a-zA-Z0-9_./-]+$ and the reserved root/default policies are refused.

Requirements

  • Terraform or OpenTofu >= 1.6
  • hashicorp/vault >= 5.0, < 6.0
  • A reachable, unsealed Vault and a token with privileges to manage sys/policies/acl, sys/auth, and sys/mounts

License

Commercial — LicenseRef-IaCBazaar-Commercial. © IaC Bazaar. Original work (not derived from a third-party module).

Usage code & full reference need an account

The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.

  • Usage
  • Inputs
  • Outputs
  • Notes
Create a free accountSign in

Related modules

Static validatedLive test pending

vault-kv-engine

KV v1 overwrites in place, so a bad write is the end of the previous secret; cas_required defaults to false, so two writers that read the same version both succeed and the second silently replaces the first; and version history is unbounded by default. v2 always, check-and-set on (off by name), versions bounded by count and age, the mount's lease ceilings set rather than inherited.

View module
Static validatedLive test pending

vault-pki-certificate-authority

Issuing from the root puts every leaf one signature from the root's compromise; a PKI role's defaults issue nothing until somebody reaches for allow_any_name, which issues for every hostname; and without AIA and CRL URLs a leaf is valid and unverifiable. A root that signs one intermediate, roles bound to allowed_domains, 30-day leaves under a 90-day ceiling, URLs on both mounts.

View module
Static validatedLive test pending

vault-approle

A secret ID with no TTL and no use limit is a password, and both default to unlimited; a role with no bound CIDRs logs in from anywhere; and a role with no max TTL mints tokens that renew forever. Secret IDs that live an hour and are used once, roles bound to the ranges they run from with unbound accepted by name, and token ceilings set.

View module
Live-tested

ansible-cfssl

cfssl and cfssljson on EL 10 from the GitHub release, each refused by Ansible's get_url unless its SHA-256 is the one in the vendor's checksums file, and re-checked by the live test, which mints a root CA from a CSR, writes it as PEM through cfssljson and reads the subject back with certinfo. Pinned; a newer release is a variable change. Original role, live-tested on Rocky Linux 10.

View module
Static validatedLive test pending

vault-database-secrets

The credential Vault connects with is still a password somebody knows until Vault rotates it; a role with no max TTL issues credentials that renew forever; and creation statements are the privilege, so a careless one is a superuser factory. Root rotation daily, TTLs per role, statements that grant exactly the PostgreSQL role you name, and the connection verified at apply.

View module
Static validatedLive test pending

vault-oidc-auth

An OIDC role with no bound claims admits every user of the identity provider; a role with no bound audience accepts tokens minted for other services; and the client secret lands in state. Bound claims expected with none accepted by name, an audience required, callbacks listed rather than assumed, token ceilings set, and the write-only secret path named for Terraform 1.11+.

View module