A Private CA that Issues from the Intermediate with Roles Bound to Domains

Issuing from the root puts every leaf one signature from the root's compromise; a PKI role's defaults issue nothing until somebody reaches for allow_any_name, which issues for every hostname; and without AIA and CRL URLs a leaf is valid and unverifiable. A root that signs one intermediate, roles bound to allowed_domains, 30-day leaves under a 90-day ceiling, URLs on both mounts.

This is the operations reference: version drift, dependants and neighbours. For what the module provisions, its inputs and outputs, and how to buy it, see the catalogue entry.

terraformMulti-cloud & platform-agnosticSecrets & KMSv1.0.0static-validated

Provider drift

This artifact declares no Terraform provider requirements, so there is nothing to drift. Provider freshness applies to Terraform and OpenTofu modules.

What depends on this

No reference architecture names this module, so changing it affects only configurations that reference it directly.

Nearest alternatives

Same cloud, same category. These are what you would weigh against it without changing provider.

A KV v2 Engine that Keeps Versions and Refuses Blind Overwrites AppRole Roles that Bind to Somewhere Specific and Issue Secret IDs that Expire Dynamic PostgreSQL Credentials with the Root Password Rotated Away OIDC Auth Whose Roles Admit the Claims You Name Transit Keys that Rotate and Cannot Be Deleted or Exported Vault Policies & Auth

The same job on other clouds

Private Certificate Authority on other providers. Useful when the cloud is still open, or when you are pricing a second one. How far a comparison like that can be trusted is covered in comparing clouds.

A Private CA that Can Revoke What It IssuesGoogle Cloud A Private CA whose Revocations Are PublishedOracle Cloud ACM Private Certificate AuthorityAWS

Installing it

module "vault_pki_certificate_authority" {
  source  = "www.iac-bazaar.com/iac-bazaar/vault-pki-certificate-authority/any"
  version = "1.0.0"
}

A registry token is required for the download itself. Installing through the registry protocol has the two credential steps.