[Token Auth] Roles not returning token_no_default_policy

[tristanmorgan]

Terraform Version

$ terraform -v
Terraform v1.0.5
on darwin_amd64
+ provider registry.terraform.io/hashicorp/consul v2.13.0
+ provider registry.terraform.io/hashicorp/external v2.1.0
+ provider registry.terraform.io/hashicorp/http v2.1.0
+ provider registry.terraform.io/hashicorp/local v2.1.0
+ provider registry.terraform.io/hashicorp/nomad v1.4.15
+ provider registry.terraform.io/hashicorp/vault v2.23.0

Affected Resource(s)

• vault_token_auth_backend_role

Terraform Configuration Files

resource "vault_token_auth_backend_role" "nomad_server" {
  role_name              = "nomad-server"
  allowed_policies       = [vault_policy.nomad_server.name]
  orphan                 = true
  token_period           = "7200"
  renewable              = true
  token_explicit_max_ttl = "0"
  token_no_default_policy = true
}

Expected Behavior

When the value of token_no_default_policy is set to true, it should be returned as true (not as drift).

Actual Behavior

This is related to a bug in Vault Roles not returning token_no_default_policy where the value set in the call to write the role is not returned and shows as drift.

Terraform will perform the following actions:

  # vault_token_auth_backend_role.nomad_cluster will be updated in-place
  ~ resource "vault_token_auth_backend_role" "nomad_cluster" {
        id                      = "auth/token/roles/nomad-cluster"
      ~ token_no_default_policy = false -> true
        # (13 unchanged attributes hidden)
    }

Steps to Reproduce

1. terraform apply
2. terraform plan

References

Are there any other GitHub issues (open or closed) or Pull Requests that should be linked here? For example:

• Vault issue 12225

[tristanmorgan]

Upstream dependancy fixed with PR:12565 VAULT-3519, waiting for release.

[tristanmorgan]

Resolved with Vault Release 1.9.0