MongoDB Atlas With Terraform: Database Users and Vault

1
provider "mongodbatlas" {}
2
provider "vault" {
3
  address = "http://localhost:8200"
4
  token = "hvs.brmNeZd31NwEmyky1uYI2wvY"
5
  skip_child_token = true
6
}

1
terraform {
2
    required_version = ">= 0.12"
3
    required_providers {
4
        mongodbatlas = {
5
            source = "mongodb/mongodbatlas"
6
            version = "1.14.0"
7
        }
8
        vault = {
9
            source = "hashicorp/vault"
10
            version = "4.0.0"
11
        }
12
    }
13
}

1
# ------------------------------------------------------------------------------
2
# RANDOM PASSWORD
3
# ------------------------------------------------------------------------------
4
resource "random_password" "default" {
5
    length = var.password_length
6
    special = false
7
}
8
9
# ------------------------------------------------------------------------------
10
# DATABASE USER
11
# ------------------------------------------------------------------------------
12
resource "mongodbatlas_database_user" "default" {
13
    project_id = data.mongodbatlas_project.default.id
14
    username = var.username
15
    password = random_password.default.result
16
    auth_database_name = var.auth_database_name
17
18
    dynamic "roles" {
19
        for_each = var.roles
20
        content {
21
            role_name = try(roles.value["role_name"], null)
22
            database_name = try(roles.value["database_name"], null)
23
            collection_name = try(roles.value["collection_name"], null)
24
        }
25
    }
26
27
    dynamic "scopes" {
28
        for_each = var.scope
29
        content {
30
            name = scopes.value["name"]
31
            type = scopes.value["type"]
32
        }
33
    }
34
35
36
    dynamic "labels" {
37
        for_each = local.tags
38
        content {
39
            key = labels.key
40
            value = labels.value
41
        }
42
    }
43
}
44
45
resource "vault_kv_secret_v2" "default" {
46
    mount = var.vault_mount
47
    name = var.secret_name
48
    data_json = jsonencode(local.secret)
49
}

1
variable "project_name" {
2
    description = "The name of the Atlas project"
3
    type = string
4
}
5
6
variable "cluster_name" {
7
    description = "The name of the Atlas cluster"
8
    type = string
9
}
10
11
variable "password_length" {
12
    description = "The length of the password"
13
    type = number
14
    default = 20
15
}
16
17
variable "username" {
18
    description = "The username of the database user"
19
    type = string
20
}
21
22
variable "auth_database_name" {
23
    description = "The name of the database in which the user is created"
24
    type = string
25
    default = "admin"
26
}
27
28
variable "roles" {
29
    description = <<HEREDOC
30
    Required - One or more user roles blocks.
31
    HEREDOC
32
    type = list(map(string))
33
}
34
35
variable "scope" {
36
    description = "The scopes to assign to the user"
37
    type = list(object({
38
        name = string
39
        type = string
40
    }))
41
    default = []
42
}
43
44
variable "labels" {
45
    type = map(any)
46
    default = null
47
    description = "A JSON containing additional labels"
48
}
49
50
variable "uri_options" {
51
    type = string
52
    default = "retryWrites=true&w=majority&readPreference=secondaryPreferred"
53
    description = "A string containing additional URI configs"
54
}
55
56
variable "vault_mount" {
57
    description = "The mount point for the Vault secret"
58
    type = string
59
}
60
61
variable "secret_name" {
62
    description = "The name of the Vault secret"
63
    type = string
64
}
65
66
variable "application" {
67
    description = <<HEREDOC
68
    Optional - Key-value pairs that tag and categorize the cluster for billing and organizational purposes.
69
    HEREDOC
70
    type = string
71
}
72
73
variable "environment" {
74
    description = <<HEREDOC
75
    Optional - Key-value pairs that tag and categorize the cluster for billing and organizational purposes.
76
    HEREDOC
77
    type = string
78
}

1
locals {
2
    private_connection_srv = data.mongodbatlas_advanced_cluster.default.connection_strings.0.standard_srv
3
    cluster_uri = trimprefix(local.private_connection_srv, "mongodb+srv://")
4
    private_connection_string = "mongodb+srv://${mongodbatlas_database_user.default.username}:${random_password.default.result}@${local.cluster_uri}/${var.auth_database_name}?${var.uri_options}"
5
6
    secret = { "URI" = local.private_connection_string }
7
8
    tags = {
9
    name = var.application
10
    environment = var.environment
11
    }
12
}

1
data "mongodbatlas_project" "default" {
2
    name = var.project_name
3
}
4
5
6
data "mongodbatlas_advanced_cluster" "default" {
7
    project_id = data.mongodbatlas_project.default.id
8
    name = var.cluster_name
9
}

1
project_name = "project-test"
2
username = "usr_myapp"
3
application = "teste-cluster"
4
environment = "dev"
5
cluster_name = "cluster-demo"
6
7
roles = [{
8
        "role_name" = "readWrite",
9
        "database_name" = "db1",
10
        "collection_name" = "collection1"
11
    }, {
12
        "role_name" : "read",
13
        "database_name" : "db2"
14
}]
15
16
scope = [{
17
    name = "cluster-demo",
18
    type = "CLUSTER"
19
}]
20
21
secret_name = "MY_MONGODB_SECRET"
22
vault_mount = "kv/my_app"

1
export MONGODB_ATLAS_PUBLIC_KEY="your_public_key"
2
export MONGODB_ATLAS_PRIVATE_KEY=your_private_key"