Skip to content

Commit ea7c7a9

Browse files
seanyehseanyeh
committed
Add ESC db rotator docs
1 parent ac27d8c commit ea7c7a9

File tree

3 files changed

+261
-3
lines changed

3 files changed

+261
-3
lines changed

‎content/docs/esc/integrations/rotated-secrets/_index.md

+5-3
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ Pulumi ESC Rotators enable you to rotate credentials both automatically and manu
1515

1616
To learn how to set up and use each rotator, follow the links below. To learn how to configure OpenID Connect (OIDC) for the rotators that support it, see [OpenID Connect integration](/docs/pulumi-cloud/oidc/) in the Pulumi Cloud documentation.
1717

18-
| Rotator | Description |
19-
|--------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------|
20-
| [aws-iam](/docs/esc/integrations/rotated-secrets/aws-iam/) | The `aws-iam` rotator enables you rotate access credentials for an AWS IAM User. |
18+
| Rotator | Description |
19+
|--------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------|
20+
| [aws-iam](/docs/esc/integrations/rotated-secrets/aws-iam/) | The `aws-iam` rotator enables you rotate access credentials for an AWS IAM User. |
21+
| [mysql](/docs/esc/integrations/rotated-secrets/mysql/) | The `mysql` rotator enables you to rotate user credentials for a MySQL database in your Environment. |
22+
| [postgres](/docs/esc/integrations/rotated-secrets/postgres/) | The `postgres` rotator enables you to rotate user credentials for a PostgreSQL database in your Environment. |

‎content/docs/esc/integrations/rotated-secrets/mysql.md

+128
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
---
2+
title: mysql
3+
title_tag: mysql Pulumi ESC Rotator
4+
meta_desc: The `mysql` rotator enables you to rotate credentials for MySQL.
5+
h1: mysql
6+
menu:
7+
esc:
8+
identifier: mysql-rotator
9+
parent: esc-rotated-secrets
10+
weight: 2
11+
---
12+
13+
The `mysql` rotator enables you to rotate user credentials for a MySQL database in your Environment.
14+
15+
## Example
16+
17+
```yaml
18+
values:
19+
mysql:
20+
fn::rotate::mysql:
21+
inputs:
22+
database:
23+
connector:
24+
awsLambda:
25+
roleArn: arn:aws:iam::1234567890:role/your-role
26+
lambdaArn: arn:aws:lambda...
27+
database: dbname
28+
host: <database host>
29+
port: 3306
30+
managingUser:
31+
username: managinguser
32+
password:
33+
fn::secret: mypassword
34+
rotateUsers:
35+
username1: user1
36+
username2: user2
37+
```
38+
39+
If you have existing usernames/passwords for the users to rotate that you want ESC to keep track of, you can optionally provide an initial `state`.
40+
41+
```yaml
42+
values:
43+
mysql:
44+
fn::rotate::mysql:
45+
inputs:
46+
database:
47+
connector:
48+
awsLambda:
49+
roleArn: arn:aws:iam::1234567890:role/your-role
50+
lambdaArn: arn:aws:lambda...
51+
database: dbname
52+
host: <database host>
53+
port: 3306
54+
managingUser:
55+
username: managinguser
56+
password:
57+
fn::secret: <password>
58+
rotateUsers:
59+
username1: user1
60+
username2: user2
61+
state:
62+
current:
63+
password:
64+
fn::secret: <password>
65+
username: user1
66+
previous:
67+
password:
68+
fn::secret: <password>
69+
username: user2
70+
```
71+
72+
## Setup
73+
74+
In order for ESC to connect to your database, you will need to use one of our connectors. Currently, only the AWS Lambda connector is supported.
75+
76+
## Inputs
77+
78+
| Property | Type | Description |
79+
|---------------|-----------------------------------|------------------------|
80+
| `database` | [DatabaseConfig](#databaseconfig) | Database configuration |
81+
| `rotateUsers` | [RotateUsers](#rotateusers) | Users to rotate |
82+
83+
## State (Optional)
84+
85+
| Property | Type | Description |
86+
|----------|-----------------------------------|-----------------------------------------------------------------------------------------------------------|
87+
| current | [UserCredential](#usercredential) | Current credential information. These are the newest and recommended credentials. |
88+
| previous | [UserCredential](#usercredential) | Previous credential information. These credentials are still valid, but will be phased out next rotation. |
89+
90+
## Outputs
91+
92+
| Property | Type | Description |
93+
|----------|-----------------------------------|-----------------------------------------------------------------------------------------------------------|
94+
| current | [UserCredential](#usercredential) | Current credential information. These are the newest and recommended credentials. |
95+
| previous | [UserCredential](#usercredential) | Previous credential information. These credentials are still valid, but will be phased out next rotation. |
96+
97+
### DatabaseConfig
98+
99+
| Property | Type | Description |
100+
|-------------|-----------------------------------------------------|----------------------------------|
101+
| `connector` | [DatabaseConnectorConfig](#databaseconnectorconfig) | Database connector configuration |
102+
103+
### DatabaseConnectorConfig
104+
105+
| Property | Type | Description |
106+
|-------------|-----------------------------------------------------|----------------------------------|
107+
| `awsLambda` | [AWSLambdaConfig](#awslambdaconfig) | AWS Lambda configuration |
108+
109+
### AWSLambdaConfig
110+
111+
| Property | Type | Description |
112+
|-------------|--------|-------------------------------------------|
113+
| `roleArn` | string | The ARN of the role to assume. |
114+
| `lambdaArn` | string | The ARN of the ESC Secret Rotation Lambda |
115+
116+
### RotateUsers
117+
118+
| Property | Type | Description |
119+
|-------------|--------|---------------------------------------------------------------------------------------------------------------|
120+
| `username1` | string | Username of user in the database to rotate. If no state is provided, this user will be the one to be rotated. |
121+
| `username2` | string | Username of user in the database to rotate. |
122+
123+
### UserCredential
124+
125+
| Property | Type | Description |
126+
|------------|--------|-----------------------------------|
127+
| `username` | string | Username of user in the database. |
128+
| `password` | string | Password of user in the database. |

‎content/docs/esc/integrations/rotated-secrets/postgres.md

+128
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
---
2+
title: postgres
3+
title_tag: postgres Pulumi ESC Rotator
4+
meta_desc: The `postgres` rotator enables you to rotate credentials for Postgres.
5+
h1: postgres
6+
menu:
7+
esc:
8+
identifier: postgres-rotator
9+
parent: esc-rotated-secrets
10+
weight: 3
11+
---
12+
13+
The `postgres` rotator enables you to rotate user credentials for a PostgreSQL database in your Environment.
14+
15+
## Example
16+
17+
```yaml
18+
values:
19+
postgres:
20+
fn::rotate::postgres:
21+
inputs:
22+
database:
23+
connector:
24+
awsLambda:
25+
roleArn: arn:aws:iam::1234567890:role/your-role
26+
lambdaArn: arn:aws:lambda...
27+
database: dbname
28+
host: <database host>
29+
port: 3306
30+
managingUser:
31+
username: managinguser
32+
password:
33+
fn::secret: mypassword
34+
rotateUsers:
35+
username1: user1
36+
username2: user2
37+
```
38+
39+
If you have existing usernames/passwords for the users to rotate that you want ESC to keep track of, you can optionally provide an initial `state`.
40+
41+
```yaml
42+
values:
43+
postgres:
44+
fn::rotate::postgres:
45+
inputs:
46+
database:
47+
connector:
48+
awsLambda:
49+
roleArn: arn:aws:iam::1234567890:role/your-role
50+
lambdaArn: arn:aws:lambda...
51+
database: dbname
52+
host: <database host>
53+
port: 3306
54+
managingUser:
55+
username: managinguser
56+
password:
57+
fn::secret: <password>
58+
rotateUsers:
59+
username1: user1
60+
username2: user2
61+
state:
62+
current:
63+
password:
64+
fn::secret: <password>
65+
username: user1
66+
previous:
67+
password:
68+
fn::secret: <password>
69+
username: user2
70+
```
71+
72+
## Setup
73+
74+
In order for ESC to connect to your database, you will need to use one of our connectors. Currently, only the AWS Lambda connector is supported.
75+
76+
## Inputs
77+
78+
| Property | Type | Description |
79+
|---------------|-----------------------------------|------------------------|
80+
| `database` | [DatabaseConfig](#databaseconfig) | Database configuration |
81+
| `rotateUsers` | [RotateUsers](#rotateusers) | Users to rotate |
82+
83+
## State (Optional)
84+
85+
| Property | Type | Description |
86+
|----------|-----------------------------------|-----------------------------------------------------------------------------------------------------------|
87+
| current | [UserCredential](#usercredential) | Current credential information. These are the newest and recommended credentials. |
88+
| previous | [UserCredential](#usercredential) | Previous credential information. These credentials are still valid, but will be phased out next rotation. |
89+
90+
## Outputs
91+
92+
| Property | Type | Description |
93+
|----------|-----------------------------------|-----------------------------------------------------------------------------------------------------------|
94+
| current | [UserCredential](#usercredential) | Current credential information. These are the newest and recommended credentials. |
95+
| previous | [UserCredential](#usercredential) | Previous credential information. These credentials are still valid, but will be phased out next rotation. |
96+
97+
### DatabaseConfig
98+
99+
| Property | Type | Description |
100+
|-------------|-----------------------------------------------------|----------------------------------|
101+
| `connector` | [DatabaseConnectorConfig](#databaseconnectorconfig) | Database connector configuration |
102+
103+
### DatabaseConnectorConfig
104+
105+
| Property | Type | Description |
106+
|-------------|-----------------------------------------------------|----------------------------------|
107+
| `awsLambda` | [AWSLambdaConfig](#awslambdaconfig) | AWS Lambda configuration |
108+
109+
### AWSLambdaConfig
110+
111+
| Property | Type | Description |
112+
|-------------|--------|-------------------------------------------|
113+
| `roleArn` | string | The ARN of the role to assume. |
114+
| `lambdaArn` | string | The ARN of the ESC Secret Rotation Lambda |
115+
116+
### RotateUsers
117+
118+
| Property | Type | Description |
119+
|-------------|--------|---------------------------------------------------------------------------------------------------------------|
120+
| `username1` | string | Username of user in the database to rotate. If no state is provided, this user will be the one to be rotated. |
121+
| `username2` | string | Username of user in the database to rotate. |
122+
123+
### UserCredential
124+
125+
| Property | Type | Description |
126+
|------------|--------|-----------------------------------|
127+
| `username` | string | Username of user in the database. |
128+
| `password` | string | Password of user in the database. |

0 commit comments

Comments
 (0)