Add ESC db rotator docs #14620
+261
−3
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,128 @@ | ||
| --- | ||
| title: mysql | ||
| title_tag: mysql Pulumi ESC Rotator | ||
| meta_desc: The `mysql` rotator enables you to rotate credentials for MySQL. | ||
| h1: mysql | ||
| menu: | ||
| esc: | ||
| identifier: mysql-rotator | ||
| parent: esc-rotated-secrets | ||
| weight: 2 | ||
| --- | ||
|
|
||
| The `mysql` rotator enables you to rotate user credentials for a MySQL database in your Environment. | ||
|
|
||
| ## Example | ||
|
|
||
| ```yaml | ||
| values: | ||
| mysql: | ||
| fn::rotate::mysql: | ||
| inputs: | ||
| database: | ||
| connector: | ||
| awsLambda: | ||
| roleArn: arn:aws:iam::1234567890:role/your-role | ||
| lambdaArn: arn:aws:lambda... | ||
| database: dbname | ||
| host: <database host> | ||
| port: 3306 | ||
| managingUser: | ||
| username: managinguser | ||
| password: | ||
| fn::secret: mypassword | ||
| rotateUsers: | ||
| username1: user1 | ||
| username2: user2 | ||
| ``` | ||
|
|
||
| If you have existing usernames/passwords for the users to rotate that you want ESC to keep track of, you can optionally provide an initial `state`. | ||
|
|
||
| ```yaml | ||
| values: | ||
| mysql: | ||
| fn::rotate::mysql: | ||
| inputs: | ||
| database: | ||
| connector: | ||
| awsLambda: | ||
| roleArn: arn:aws:iam::1234567890:role/your-role | ||
| lambdaArn: arn:aws:lambda... | ||
| database: dbname | ||
| host: <database host> | ||
| port: 3306 | ||
| managingUser: | ||
| username: managinguser | ||
| password: | ||
| fn::secret: <password> | ||
| rotateUsers: | ||
| username1: user1 | ||
| username2: user2 | ||
| state: | ||
| current: | ||
| password: | ||
| fn::secret: <password> | ||
| username: user1 | ||
| previous: | ||
| password: | ||
| fn::secret: <password> | ||
| username: user2 | ||
| ``` | ||
|
|
||
| ## Setup | ||
|
|
||
| In order for ESC to connect to your database, you will need to use one of our connectors. Currently, only the AWS Lambda connector is supported. | ||
|
|
||
| ## Inputs | ||
|
|
||
| | Property | Type | Description | | ||
| |---------------|-----------------------------------|------------------------| | ||
| | `database` | [DatabaseConfig](#databaseconfig) | Database configuration | | ||
| | `rotateUsers` | [RotateUsers](#rotateusers) | Users to rotate | | ||
|
|
||
| ## State (Optional) | ||
|
|
||
| | Property | Type | Description | | ||
| |----------|-----------------------------------|-----------------------------------------------------------------------------------------------------------| | ||
| | current | [UserCredential](#usercredential) | Current credential information. These are the newest and recommended credentials. | | ||
| | previous | [UserCredential](#usercredential) | Previous credential information. These credentials are still valid, but will be phased out next rotation. | | ||
|
|
||
| ## Outputs | ||
|
|
||
| | Property | Type | Description | | ||
| |----------|-----------------------------------|-----------------------------------------------------------------------------------------------------------| | ||
| | current | [UserCredential](#usercredential) | Current credential information. These are the newest and recommended credentials. | | ||
| | previous | [UserCredential](#usercredential) | Previous credential information. These credentials are still valid, but will be phased out next rotation. | | ||
|
|
||
| ### DatabaseConfig | ||
|
|
||
| | Property | Type | Description | | ||
| |-------------|-----------------------------------------------------|----------------------------------| | ||
| | `connector` | [DatabaseConnectorConfig](#databaseconnectorconfig) | Database connector configuration | | ||
|
There was a problem hiding this comment. We're missing other properties here |
||
|
|
||
| ### DatabaseConnectorConfig | ||
|
|
||
| | Property | Type | Description | | ||
| |-------------|-----------------------------------------------------|----------------------------------| | ||
| | `awsLambda` | [AWSLambdaConfig](#awslambdaconfig) | AWS Lambda configuration | | ||
|
|
||
| ### AWSLambdaConfig | ||
|
|
||
| | Property | Type | Description | | ||
| |-------------|--------|-------------------------------------------| | ||
| | `roleArn` | string | The ARN of the role to assume. | | ||
| | `lambdaArn` | string | The ARN of the ESC Secret Rotation Lambda | | ||
|
|
||
| ### RotateUsers | ||
|
|
||
| | Property | Type | Description | | ||
| |-------------|--------|---------------------------------------------------------------------------------------------------------------| | ||
| | `username1` | string | Username of user in the database to rotate. If no state is provided, this user will be the one to be rotated. | | ||
| | `username2` | string | Username of user in the database to rotate. | | ||
|
|
||
| ### UserCredential | ||
|
|
||
| | Property | Type | Description | | ||
| |------------|--------|-----------------------------------| | ||
| | `username` | string | Username of user in the database. | | ||
| | `password` | string | Password of user in the database. | | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,128 @@ | ||
| --- | ||
| title: postgres | ||
| title_tag: postgres Pulumi ESC Rotator | ||
| meta_desc: The `postgres` rotator enables you to rotate credentials for Postgres. | ||
| h1: postgres | ||
| menu: | ||
| esc: | ||
| identifier: postgres-rotator | ||
| parent: esc-rotated-secrets | ||
| weight: 3 | ||
| --- | ||
|
|
||
| The `postgres` rotator enables you to rotate user credentials for a PostgreSQL database in your Environment. | ||
|
|
||
| ## Example | ||
|
|
||
| ```yaml | ||
| values: | ||
| postgres: | ||
| fn::rotate::postgres: | ||
| inputs: | ||
| database: | ||
| connector: | ||
| awsLambda: | ||
| roleArn: arn:aws:iam::1234567890:role/your-role | ||
| lambdaArn: arn:aws:lambda... | ||
| database: dbname | ||
| host: <database host> | ||
| port: 3306 | ||
| managingUser: | ||
| username: managinguser | ||
| password: | ||
| fn::secret: mypassword | ||
| rotateUsers: | ||
| username1: user1 | ||
| username2: user2 | ||
| ``` | ||
|
|
||
| If you have existing usernames/passwords for the users to rotate that you want ESC to keep track of, you can optionally provide an initial `state`. | ||
|
|
||
| ```yaml | ||
| values: | ||
| postgres: | ||
| fn::rotate::postgres: | ||
| inputs: | ||
| database: | ||
| connector: | ||
| awsLambda: | ||
| roleArn: arn:aws:iam::1234567890:role/your-role | ||
| lambdaArn: arn:aws:lambda... | ||
| database: dbname | ||
| host: <database host> | ||
| port: 3306 | ||
| managingUser: | ||
| username: managinguser | ||
| password: | ||
| fn::secret: <password> | ||
| rotateUsers: | ||
| username1: user1 | ||
| username2: user2 | ||
| state: | ||
| current: | ||
| password: | ||
| fn::secret: <password> | ||
| username: user1 | ||
| previous: | ||
| password: | ||
| fn::secret: <password> | ||
| username: user2 | ||
| ``` | ||
|
|
||
| ## Setup | ||
|
|
||
| In order for ESC to connect to your database, you will need to use one of our connectors. Currently, only the AWS Lambda connector is supported. | ||
|
|
||
| ## Inputs | ||
|
|
||
| | Property | Type | Description | | ||
| |---------------|-----------------------------------|------------------------| | ||
| | `database` | [DatabaseConfig](#databaseconfig) | Database configuration | | ||
| | `rotateUsers` | [RotateUsers](#rotateusers) | Users to rotate | | ||
|
|
||
| ## State (Optional) | ||
|
|
||
| | Property | Type | Description | | ||
| |----------|-----------------------------------|-----------------------------------------------------------------------------------------------------------| | ||
| | current | [UserCredential](#usercredential) | Current credential information. These are the newest and recommended credentials. | | ||
| | previous | [UserCredential](#usercredential) | Previous credential information. These credentials are still valid, but will be phased out next rotation. | | ||
|
|
||
| ## Outputs | ||
|
|
||
| | Property | Type | Description | | ||
| |----------|-----------------------------------|-----------------------------------------------------------------------------------------------------------| | ||
| | current | [UserCredential](#usercredential) | Current credential information. These are the newest and recommended credentials. | | ||
| | previous | [UserCredential](#usercredential) | Previous credential information. These credentials are still valid, but will be phased out next rotation. | | ||
|
|
||
| ### DatabaseConfig | ||
|
|
||
| | Property | Type | Description | | ||
| |-------------|-----------------------------------------------------|----------------------------------| | ||
| | `connector` | [DatabaseConnectorConfig](#databaseconnectorconfig) | Database connector configuration | | ||
|
|
||
| ### DatabaseConnectorConfig | ||
|
|
||
| | Property | Type | Description | | ||
| |-------------|-----------------------------------------------------|----------------------------------| | ||
| | `awsLambda` | [AWSLambdaConfig](#awslambdaconfig) | AWS Lambda configuration | | ||
|
|
||
| ### AWSLambdaConfig | ||
|
|
||
| | Property | Type | Description | | ||
| |-------------|--------|-------------------------------------------| | ||
| | `roleArn` | string | The ARN of the role to assume. | | ||
| | `lambdaArn` | string | The ARN of the ESC Secret Rotation Lambda | | ||
|
|
||
| ### RotateUsers | ||
|
|
||
| | Property | Type | Description | | ||
| |-------------|--------|---------------------------------------------------------------------------------------------------------------| | ||
| | `username1` | string | Username of user in the database to rotate. If no state is provided, this user will be the one to be rotated. | | ||
| | `username2` | string | Username of user in the database to rotate. | | ||
|
|
||
| ### UserCredential | ||
|
|
||
| | Property | Type | Description | | ||
| |------------|--------|-----------------------------------| | ||
| | `username` | string | Username of user in the database. | | ||
| | `password` | string | Password of user in the database. | |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
not sure if there is a better way to word this
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not sure we should be introducing the term "connector" before we're fully committed to it - I think in Pat's doc they were called "callbacks", but that might be too generic, as this is specifically a "rotation agent", another term we used to talk about this concept. So we should 100% align before putting it out there.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nevermind, I see that it's already baked into the schema in the PR adding the rotators - https://github.com/pulumi/pulumi-service/pull/26199/files
I probably just missed the discussion