Configure a database connection.

Sets up the database connection parameters that Vault will use to communicate with the database and generate credentials. Supports multiple database types through plugin system.

Parameters

• name - Connection name
• config - Connection configuration parameters
• opts - Request options including mount path

Examples

# MySQL connection
config = %{
  plugin_name: "mysql-database-plugin",
  connection_url: "{{username}}:{{password}}@tcp(127.0.0.1:3306)/",
  username: "vaultuser",
  password: "secretpassword",
  allowed_roles: ["readonly"]
}
{:ok, _} = Database.configure_connection("mysql", config)

# PostgreSQL with TLS and advanced configuration
config = %{
  plugin_name: "postgresql-database-plugin",
  connection_url: "postgresql://{{username}}:{{password}}@localhost:5432/postgres?sslmode=require",
  username: "vaultuser",
  password: "secretpassword",
  max_open_connections: 10,
  max_idle_connections: 5,
  max_connection_lifetime: "30s",
  username_template: "v-{{.RoleName}}-{{random 8}}-{{unix_time}}",
  password_authentication: "scram-sha-256",  # For PostgreSQL 10+
  disable_escaping: false
}

# PostgreSQL with multiple hosts for High Availability
ha_config = %{
  plugin_name: "postgresql-database-plugin",
  connection_url: "postgresql://{{username}}:{{password}}@primary:5432,secondary:5432/postgres",
  username: "vaultuser",
  password: "secretpassword",
  allowed_roles: ["readonly", "readwrite"]
}

# PostgreSQL with Google Cloud SQL IAM authentication
gcp_config = %{
  plugin_name: "postgresql-database-plugin",
  connection_url: "host=/cloudsql/project:region:instance user={{username}} password={{password}} dbname=postgres",
  auth_type: "gcp_iam",
  service_account_json: "{"type":"service_account","project_id":"my-project"}",
  use_private_ip: true,
  allowed_roles: ["app-readonly"]
}

Create or update a dynamic database role.

Configures a role that can be used to generate dynamic database credentials. The role defines the database statements and constraints for credential generation.

Parameters

• name - Role name
• config - Role configuration parameters
• opts - Request options

Examples

# MySQL readonly role
config = %{
  db_name: "mysql",
  creation_statements: [
    "CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}'",
    "GRANT SELECT ON *.* TO '{{name}}'@'%'"
  ],
  default_ttl: 3600,
  max_ttl: 86400
}
:ok = Database.create_role("readonly", config)

# PostgreSQL role with schema permissions and advanced features
config = %{
  db_name: "postgres",
  creation_statements: [
    "CREATE ROLE "{{name}}" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';",
    "GRANT SELECT ON ALL TABLES IN SCHEMA public TO "{{name}}";",
    "GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO "{{name}}";"
  ],
  revocation_statements: [
    "REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM "{{name}}";",
    "REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM "{{name}}";",
    "DROP ROLE IF EXISTS "{{name}}";"
  ],
  renew_statements: [
    "ALTER ROLE "{{name}}" VALID UNTIL '{{expiration}}';"
  ],
  rollback_statements: [
    "DROP ROLE IF EXISTS "{{name}}";"
  ]
}

Delete a database connection.

Examples

:ok = Database.delete_connection("old-connection")

Delete a dynamic database role.

Examples

:ok = Database.delete_role("old-role")

Generate credentials for a dynamic database role.

Generates dynamic database credentials based on the given role definition.

Parameters

• name - Role name to generate credentials for
• opts - Request options

Returns

• {:ok, credentials} - Successfully generated credentials
• {:error, error} - Failed to generate credentials

Examples

{:ok, creds} = Database.generate_credentials("readonly")
%{
  username: "root-1430158508-126",
  password: "132ae3ef-5a64-7499-351e-bfe59f3a2a21"
}

List all configured database connections.

Examples

{:ok, connections} = Database.list_connections()
["mysql", "postgres", "mongodb"]

List all configured dynamic database roles.

Examples

{:ok, roles} = Database.list_roles()
["readonly", "readwrite", "admin"]

Read database connection configuration.

Examples

{:ok, config} = Database.read_connection("mysql")
%{
  allowed_roles: ["readonly"],
  connection_details: %{
    connection_url: "{{username}}:{{password}}@tcp(127.0.0.1:3306)/",
    username: "vaultuser"
  },
  plugin_name: "mysql-database-plugin"
}

Read a dynamic database role configuration.

Examples

{:ok, config} = Database.read_role("readonly")
%{
  creation_statements: [
    "CREATE ROLE "{{name}}" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';",
    "GRANT SELECT ON ALL TABLES IN SCHEMA public TO "{{name}}";"
  ],
  credential_type: "password",
  db_name: "postgres",
  default_ttl: 3600,
  max_ttl: 86400
}

Reload all connections for a specific plugin.

Examples

{:ok, result} = Database.reload_plugin("postgresql-database-plugin")
%{connections: ["pg1", "pg2"], count: 2}

Reset a database connection.

Closes the connection and restarts it with stored configuration.

Examples

:ok = Database.reset_connection("mysql")

Rotate root credentials for a database connection.

Examples

:ok = Database.rotate_root_credentials("mysql")