gcp_se.tf

# setup the secrets engine
resource "vault_gcp_secret_backend" "gcp" {
  description               = var.GCP_SE_DESCRIPTION
  path                      = "gcp/${var.GCP_SE_PATH}"
  credentials               = file(var.GCP_SE_CREDENTIALS_PATH) # google credentials in a json file
  default_lease_ttl_seconds = var.GCP_SE_TTL
  max_lease_ttl_seconds     = var.GCP_SE_TTL_MAX
}

# Setup the role binding
resource "vault_gcp_secret_roleset" "gcp_se" {
  backend      = vault_gcp_secret_backend.gcp.path
  roleset      = var.GCP_SE_ROLESET
  secret_type  = "service_account_key"
  project      = var.GCP_SE_PROJECT
  token_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
  binding {
    resource = "//cloudresourcemanager.googleapis.com/projects/${var.GCP_SE_PROJECT}"
    roles    = var.GCP_SE_ROLES
  }
}