Skip to content

Commit 4f48743

Browse files
boruszakboruszak
authored
Merge branch 'main' into docs/CE-1060-add-change-organization-owners
2 parents 35061c2 + 7d6a8d3 commit 4f48743

File tree

1,892 files changed

+1576
-514
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,892 files changed

+1576
-514
lines changed

‎.github/workflows/create-tfe-release-notes.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -34,20 +34,20 @@ env:
3434
LAST_RELEASE_TAG: ${{ inputs.last-release-tag }}
3535

3636
jobs:
37-
copy-docs:
38-
uses: ./.github/workflows/copy-cloud-docs-for-tfe.yml
37+
sync-docs:
38+
uses: ./.github/workflows/sync-docs-for-tfe.yml
3939
with:
4040
version: ${{ inputs.version }}
4141
secrets: inherit
4242
release-notes:
43-
needs: copy-docs
43+
needs: sync-docs
4444
runs-on: ubuntu-latest
4545
steps:
46-
- name: Print outputs from copy-docs
46+
- name: Print outputs from sync-docs
4747
run: |
48-
echo "release_branch_name: ${{ needs.copy-docs.outputs.release_branch_name }}"
49-
echo "diff_branch_pr_url: ${{ needs.copy-docs.outputs.diff_branch_pr_url }}"
50-
echo "release_branch_pr_url: ${{ needs.copy-docs.outputs.release_branch_pr_url }}"
48+
echo "release_branch_name: ${{ needs.sync-docs.outputs.release_branch_name }}"
49+
echo "diff_branch_pr_url: ${{ needs.sync-docs.outputs.diff_branch_pr_url }}"
50+
echo "release_branch_pr_url: ${{ needs.sync-docs.outputs.release_branch_pr_url }}"
5151
5252
- name: Only run in hashicorp/web-unified-docs-internal
5353
run: |
@@ -59,7 +59,7 @@ jobs:
5959
- name: Checkout web-unified-docs repository
6060
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
6161
with:
62-
ref: '${{ needs.copy-docs.outputs.release_branch_name }}'
62+
ref: '${{ needs.sync-docs.outputs.release_branch_name }}'
6363

6464
- name: Install and cache Ruby gems at root
6565
uses: ruby/setup-ruby@52753b7da854d5c07df37391a986c76ab4615999 # v1.191.0
@@ -74,7 +74,7 @@ jobs:
7474

7575
- name: Turn branch into PR
7676
run: |
77-
export RELEASE_BRANCH_NAME="${{ needs.copy-docs.outputs.release_branch_name }}"
77+
export RELEASE_BRANCH_NAME="${{ needs.sync-docs.outputs.release_branch_name }}"
7878
RELEASE_NOTES_PR_URL=$(scripts/tfe-releases/ci/create-pull-request.sh)
7979
echo "RELEASE_NOTES_PR_URL=$RELEASE_NOTES_PR_URL" >> $GITHUB_ENV
8080
@@ -134,10 +134,10 @@ jobs:
134134
- ${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}
135135
136136
Changes since last release, diff PR:
137-
- ${{ needs.copy-docs.outputs.diff_branch_pr_url }}
137+
- ${{ needs.sync-docs.outputs.diff_branch_pr_url }}
138138
139139
Release Notes PR:
140-
- ${{ needs.copy-docs.outputs.release_branch_pr_url }}
140+
- ${{ needs.sync-docs.outputs.release_branch_pr_url }}
141141
142142
143143
❗ This is the Release PR that will be merged into main, once the release notes and diff PR are merged into it. ❗
@@ -149,5 +149,5 @@ jobs:
149149
git config --global user.email "[email protected]"
150150
git config --global user.name "tfe-release-bot"
151151
152-
gh pr edit ${{ needs.copy-docs.outputs.release_branch_pr_url }} \
152+
gh pr edit ${{ needs.sync-docs.outputs.release_branch_pr_url }} \
153153
--body="${{env.docs_pr_body}}"

‎.github/workflows/sync-docs-for-tfe.yml‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
name: Sync Cloud Docs For TFE
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
version:
7+
description: 'The TFE version for the upcoming TFE release, format is either vYYYYMM-# or MAJOR.MINOR.PATCH (without a "v" prefix).'
8+
required: true
9+
type: string
10+
workflow_call:
11+
inputs:
12+
version:
13+
description: 'The TFE version for the upcoming TFE release, format is either vYYYYMM-# or MAJOR.MINOR.PATCH (without a "v" prefix).'
14+
required: true
15+
type: string
16+
outputs:
17+
release_branch_name:
18+
description: 'The name of the branch created for the new TFE version docs.'
19+
value: ${{ jobs.sync-docs.outputs.release_branch_name }}
20+
release_branch_pr_url:
21+
description: 'The URL of the release branch created for the new TFE version docs.'
22+
value: ${{ jobs.sync-docs.outputs.release_branch_pr_url }}
23+
diff_branch_pr_url:
24+
description: 'The URL of the diff branch created for the new TFE version docs.'
25+
value: ${{ jobs.sync-docs.outputs.diff_branch_pr_url }}
26+
27+
jobs:
28+
sync-docs:
29+
name: Sync Cloud Docs
30+
runs-on: ubuntu-latest
31+
outputs:
32+
release_branch_name: ${{ steps.check-docs-pr.outputs.docs_branch_name }}
33+
release_branch_pr_url: ${{ steps.check-docs-pr.outputs.release_branch_pr_url }}
34+
diff_branch_pr_url: ${{ steps.update-diff-branch.outputs.diff_branch_pr_url }}
35+
steps:
36+
- name: Series/Release Summary
37+
run: |
38+
echo "# Summary" >> $GITHUB_STEP_SUMMARY
39+
echo "**Workflow ref**: ${{github.ref_name}}" >> $GITHUB_STEP_SUMMARY
40+
echo "" >> $GITHUB_STEP_SUMMARY
41+
echo "Triggered by branch creation (or manual workflow):" >> $GITHUB_STEP_SUMMARY
42+
echo "" >> $GITHUB_STEP_SUMMARY
43+
echo "" >> $GITHUB_STEP_SUMMARY
44+
echo "---" >> $GITHUB_STEP_SUMMARY
45+
46+
- name: Checkout main for new docs version
47+
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
48+
with:
49+
path: '${{github.workspace}}/new-docs'
50+
51+
- name: Check if new TFE version docs branch already exist
52+
id: check-docs-pr
53+
working-directory: '${{github.workspace}}/new-docs'
54+
env:
55+
docs_branch_name: tfe-release/${{inputs.version}}
56+
diff_branch_name: HCPTF-diff/${{inputs.version}}
57+
run: |
58+
echo ${{ secrets.TFE_GITHUB_TOKEN }} | gh auth login --with-token
59+
git config --global user.email "[email protected]"
60+
git config --global user.name "tfe-release-bot"
61+
62+
if [ "$(git ls-remote --heads origin ${{env.docs_branch_name}})" == "" ]; then
63+
echo "❌ branch name ${{env.docs_branch_name}} does not exists, please run copy cloud docs for tfe workflow first to create the branch."
64+
65+
echo "❌ branch name ${{env.docs_branch_name}} does not exists, please run copy cloud docs for tfe workflow first to create the branch." >> $GITHUB_STEP_SUMMARY
66+
67+
exit 1
68+
fi
69+
70+
if [ "$(git ls-remote --heads origin ${{env.diff_branch_name}})" == "" ]; then
71+
echo "❌ branch name ${{env.diff_branch_name}} does not exists, please run copy cloud docs for tfe workflow first to create the branch."
72+
73+
echo "❌ branch name ${{env.diff_branch_name}} does not exists, please run copy cloud docs for tfe workflow first to create the branch." >> $GITHUB_STEP_SUMMARY
74+
75+
exit 1
76+
fi
77+
78+
echo "docs_branch_name=${{env.docs_branch_name}}" >> $GITHUB_OUTPUT
79+
docs_pr_url=$(gh pr view ${{env.docs_branch_name}} --json url --jq '.url')
80+
echo "release_branch_pr_url=${docs_pr_url}" >> $GITHUB_OUTPUT
81+
echo "**TFE Release PR URL**: ${docs_pr_url}" >> $GITHUB_STEP_SUMMARY
82+
83+
- name: Generate version-metadata for workflow
84+
working-directory: '${{github.workspace}}/new-docs'
85+
run: |
86+
npm i
87+
npm run prebuild -- --only-build-version-metadata
88+
89+
- name: Checkout HCPTF-diff for new docs version DIFF PR
90+
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
91+
with:
92+
path: '${{github.workspace}}/new-docs-diff-pr'
93+
ref: 'HCPTF-diff/${{inputs.version}}'
94+
95+
- name: Copy files for new docs version DIFF PR
96+
uses: ./new-docs/.github/actions/copy-cloud-docs-for-tfe
97+
with:
98+
source_path: '${{github.workspace}}/new-docs'
99+
target_path: '${{github.workspace}}/new-docs-diff-pr'
100+
new_TFE_version: ${{inputs.version}}
101+
102+
- name: Update existing docs version DIFF branch
103+
id: update-diff-branch
104+
working-directory: '${{github.workspace}}/new-docs-diff-pr'
105+
env:
106+
diff_branch_name: HCPTF-diff/${{inputs.version}}
107+
run: |
108+
echo ${{ secrets.TFE_GITHUB_TOKEN }} | gh auth login --with-token
109+
git config --global user.email "[email protected]"
110+
git config --global user.name "tfe-release-bot"
111+
112+
git add .
113+
git commit -m "HCP TF changes for TFE release" --no-verify || echo "No changes to commit"
114+
git push origin HEAD
115+
116+
diff_pr_url=$(gh pr view --json url --jq '.url')
117+
echo "diff_branch_pr_url=${diff_pr_url}" >> $GITHUB_OUTPUT
118+
echo "**Updated DIFF branch**: ${{env.diff_branch_name}}" >> $GITHUB_STEP_SUMMARY
119+
echo "**TFE DIFF PR URL**: ${diff_pr_url}" >> $GITHUB_STEP_SUMMARY

‎CODEOWNERS‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -27,29 +27,27 @@
2727

2828
/content/terraform-enterprise @hashicorp/team-docs-packer-and-terraform @hashicorp/ptfe-review
2929

30-
3130
# Vault documentation ownership
32-
3331
/content/vault/ @hashicorp/vault-education-approvers
3432

3533
# Sentinel documentation ownership
3634
/content/sentinel/ @hashicorp/team-docs-packer-and-terraform @hashicorp/tf-compliance
3735

3836
# Well-architected framework
39-
4037
/content/well-architected-framework/ @hashicorp/well-architected-education-approvers
4138

42-
4339
# HCP-docs documentation ownership
40+
/content/hcp-docs/* @hashicorp/education
41+
4442
# HCP Consul Docs
4543
/content/hcp-docs/content/docs/consul/* @hashicorp/consul-docs
4644

47-
# HCP Vault & HCP Vault Secrets docs
48-
/content/hcp-docs/content/docs/vault/* @hashicorp/vault-education-approvers
49-
/content/hcp-docs/content/docs/vault-secrets/* @hashicorp/vault-education-approvers
45+
# HCP Vault & HCP Vault Radar docs
46+
/content/hcp-docs/content/docs/vault* @hashicorp/vault-education-approvers
47+
/content/hcp-docs/content/partials/vault* @hashicorp/vault-education-approvers
5048

5149
# HCP Boundary docs
52-
/content/hcp-docs/content/docs/boundary/* @hashicorp/boundary-education-approvers
50+
/content/hcp-docs/content/docs/boundary/* @hashicorp/boundary-education-approvers
5351

5452
#HCP IAM
5553
/content/hcp-docs/content/partials/hcp-administration/* @hashicorp/cloud-access-control @hashicorp/cloud-identity

‎content/hcp-docs/content/docs/vault-radar/agent/correlate-aws-secrets-manager.mdx‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
---
2+
page_title: Correlate findings with AWS Secrets Manager
3+
description: >-
4+
Correlate findings from HCP Vault Radar with secrets stored in AWS Secrets Manager.
5+
---
6+
7+
# Correlate findings with AWS Secrets Manager
8+
9+
When HCP Vault Radar connects to AWS Secrets Manager, Vault Radar can correlate
10+
findings with secrets stored in AWS Secrets Manager. This allows you to identify
11+
what secrets you need to rotate.
12+
13+
## Connect AWS Secrets Manager
14+
15+
Before you can correlate findings with AWS Secrets Manager, you need to [deploy
16+
the Radar agent](/hcp/docs/vault-radar/agent/deploy). Once you deploy the agent,
17+
you can configure and connect AWS Secrets Manager to the agent.
18+
19+
## Prerequisites
20+
21+
You need one of the following AWS authentication methods:
22+
23+
- IAM role authentication with an EC2 instance or configured IAM role
24+
- Environment variables authentication with AWS Access Key ID and Secret Access Key
25+
26+
Both authentication methods support an optional assume role ARN for
27+
cross-account access or elevated permissions. For more information about
28+
assuming roles, refer to the [AWS STS AssumeRole
29+
documentation](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html).
30+
31+
### Required permissions
32+
33+
The IAM user, role, or assumed role must have the following permissions:
34+
35+
| Service | Permission | Documentation |
36+
|---------|------------|---------------|
37+
| Secrets Manager | `secretsmanager:ListSecrets` | [ListSecrets API](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ListSecrets.html) |
38+
| Secrets Manager | `secretsmanager:DescribeSecret` | [DescribeSecret API](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DescribeSecret.html) |
39+
| Secrets Manager | `secretsmanager:GetSecretValue` | [GetSecretValue API](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html) |
40+
| Secrets Manager | `secretsmanager:ListSecretVersionIds` | [ListSecretVersionIds API](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ListSecretVersionIds.html) |
41+
| EC2 | `ec2:DescribeRegions` | [DescribeRegions API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRegions.html) |
42+
| STS | `sts:GetCallerIdentity` | [GetCallerIdentity API](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html) |
43+
44+
**Example AWS IAM policy:**
45+
46+
```json
47+
{
48+
"Version": "2012-10-17",
49+
"Statement": [
50+
{
51+
"Effect": "Allow",
52+
"Action": [
53+
"secretsmanager:ListSecrets",
54+
"secretsmanager:DescribeSecret",
55+
"secretsmanager:GetSecretValue",
56+
"secretsmanager:ListSecretVersionIds"
57+
],
58+
"Resource": "*"
59+
},
60+
{
61+
"Effect": "Allow",
62+
"Action": [
63+
"ec2:DescribeRegions"
64+
],
65+
"Resource": "*"
66+
},
67+
{
68+
"Effect": "Allow",
69+
"Action": [
70+
"sts:GetCallerIdentity"
71+
],
72+
"Resource": "*"
73+
}
74+
]
75+
}
76+
```
77+
78+
## Agent configuration with AWS Secrets Manager
79+
80+
Set up and manage AWS Secrets Manager from the Vault Radar module in the [HCP
81+
Portal](https://portal.cloud.hashicorp.com/).
82+
83+
1. Click **Settings**.
84+
85+
1. Click **Secret Managers**.
86+
87+
1. Click **Connect new secret manager**.
88+
89+
1. Select **AWS Secrets Manager** and click **Next**.
90+
91+
1. Select an AWS authentication method from the **Authentication method** pulldown menu.
92+
93+
1. Enter the details for the selected method and click **Next** to validate the connection.
94+
95+
<Tabs>
96+
<Tab heading="IAM Role">
97+
98+
- Select **IAM Role** if you want to use instance profile or role-based authentication.
99+
100+
![IAM Role](/img/docs/vault-radar/indexing/aws-secrets-manager/iam-role.png)
101+
102+
- (Optional) Enter an assume role ARN in the **Assume Role ARN** text field if you need to assume a different role for access.
103+
104+
</Tab>
105+
<Tab heading="Environment Variables">
106+
107+
- Select **AWS Credentials from environment variables** if you want to use access keys.
108+
109+
![Environment Variables](/img/docs/vault-radar/indexing/aws-secrets-manager/environment-variables.png)
110+
111+
- Enter your AWS Access Key ID location in the **AWS Access Key ID Env variable** text field (default: `env://AWS_ACCESS_ID_LOCATION`).
112+
113+
- Enter your AWS Secret Access Key location in the **AWS Secret Access Key Env variable** text field (default: `env://AWS_SECRET_KEY_LOCATION`).
114+
115+
- (Optional) Enter an assume role ARN in the **Assume Role ARN** text field if you need to assume a different role for access.
116+
117+
</Tab>
118+
</Tabs>
119+
120+
Vault Radar fetches all active regions for the account and automatically starts index scan for each region.

‎content/hcp-docs/content/docs/vault-radar/agent/correlate-vault.mdx‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,26 @@ Vault Dedicated or Vault Enterprise clusters.
1313

1414
</Highlight>
1515

16-
When the HCP Vault Radar agent connects to a HCP Vault Dedicated or Vault Enterprise cluster,
16+
When the Vault Radar agent connects to a Vault Dedicated or Vault Enterprise cluster,
1717
Vault Radar can correlate findings with secrets stored in Vault. This allows you to identify
1818
what secrets you need to rotate.
1919

2020
## Connect a Vault cluster
2121

2222
Before you can correlate findings with Vault, you need to [deploy the Radar
2323
agent](/hcp/docs/vault-radar/agent/deploy). Once you deploy the agent, you can
24-
configured and connect Vault to the agent.
24+
configure and connect Vault to the agent.
25+
26+
## Prerequisites
27+
28+
You need one of the following Vault authentication methods:
29+
30+
- Kubernetes
31+
- AppRole
32+
- Token
33+
34+
The authentication methods require a policy that allows the Vault Radar agent to
35+
read all KV secrets from Vault.
2536

2637
### Create a Vault policy
2738

‎content/hcp-docs/data/docs-nav-data.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -931,6 +931,10 @@
931931
{
932932
"title": "Integrate Vault Enterprise",
933933
"path": "vault-radar/agent/correlate-vault"
934+
},
935+
{
936+
"title": "Integrate AWS Secrets Manager",
937+
"path": "vault-radar/agent/correlate-aws-secrets-manager"
934938
}
935939
]
936940
},

‎content/hcp-docs/img/docs/vault-radar/indexing/aws-secrets-manager/environment-variables.png‎

187 KB
Loading

‎content/hcp-docs/img/docs/vault-radar/indexing/aws-secrets-manager/iam-role.png‎

114 KB
Loading

‎content/terraform-docs-agents/v1.24.x/docs/cloud-docs/agents/agent-pools.mdx‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,12 @@ The workspace begins using the agent for Terraform runs. Runs involving an agent
8686

8787
## Configure Stacks to use the agent
8888

89+
<Note>
90+
91+
Your agents must use v1.25.0 or above to execute Stack deployment runs. To learn more about agent versioning, refer to [Updates](/terraform/cloud-docs/agents/agents#updates).
92+
93+
</Note>
94+
8995
Use the following steps to configure a Stack to use an agent pool.
9096

9197
### Step 1: Manage existing runs

0 commit comments

Comments
 (0)