terraform-provider-stackgen

sg_vault_aws_config (Data Source)

Fetches IAM setup values from Vault GET /integration/aws/config for the current workspace. Use external_id and bastion_role_arn in your customer IAM role trust policy when sg_secret uses metadata.auth_method = "assume_role". Put only your customer role ARN in sg_secret metadata as aws_role_arn. Not required for metadata.auth_method = "access_keys" secrets.

Example Usage

# Workspace IAM setup values from Vault GET /integration/aws/config.
# external_id is stable per workspace — reuse when rotating customer roles.
data "sg_vault_aws_config" "workspace" {
  org_id = var.stackgen_project_id
}

# Customer IAM role: trust policy comes from Vault (bastion principal + external ID).
resource "aws_iam_role" "stackgen_readonly" {
  name               = "stackgen-aws-integration"
  assume_role_policy = data.sg_vault_aws_config.workspace.trust_policy
}

# Vault secret: set only your customer role ARN and region.
# Do not set external_id — Vault injects it on create/update.
resource "sg_secret" "aws" {
  name        = "prod-aws"
  description = "AWS cross-account read-only integration"
  category    = "CloudProvider"
  subcategory = "aws"
  org_id      = var.stackgen_project_id

  metadata = {
    aws_role_arn = aws_iam_role.stackgen_readonly.arn
    aws_region   = var.aws_region
  }
}

variable "stackgen_project_id" {
  type        = string
  description = "StackGen workspace (project) UUID."
}

variable "aws_region" {
  type        = string
  description = "Default AWS region for assume-role sessions."
}

Schema

Optional

Read-Only