From 3abeb75ca5e8c21676535463f42bf2bef6e4f152 Mon Sep 17 00:00:00 2001 From: Todd Knight Date: Thu, 18 Nov 2021 08:57:54 -0700 Subject: [PATCH] Update Readme with details around credential rotation needing to be disabled. --- README.md | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index fff36ae..e3e99f2 100644 --- a/README.md +++ b/README.md @@ -19,24 +19,21 @@ Current limitations of this plugin: compute resource - A client secret must be generated against a registered application with any necessary permissions +- Credential rotation must be disabled using the `disable_credential_rotation` + attribute. ## Credential Rotation -Although credentials are stored encrypted within Boundary, by default this -plugin will attempt to rotate credentials when they are supplied through the -`secrets` object on a create or update call to the host catalog resource. The -given credentials will be used to create a new credential, and then the given -credential will be revoked. In this way, after rotation, only Boundary knows the -client secret in use by this plugin. +*NOTE*: For now credential rotation must be explicitly disabled by setting +`disable_credential_rotation`to true on the host catalog. When we lift this +restriction boundary will manage the rotation of credentials for you. -*NOTE*: Azure's credentials are eventually consistent and there may be -significant delay (up to ten minutes or more) between when a credential is -created and is available for use, or when a credential is deleted and -unavailable for use. At the API level, this can be true even if the Azure Portal -indicates that the credential is (or isn't) there. This delay will manifest as -authentication failures when performing actions using this plugin. If secrets -have just been supplied and `disable_credential_rotation` is not specified, -please be patient and try again later. +Although credentials are stored encrypted within Boundary, when credential +rotation isn't explicitly disabled, this plugin will attempt to rotate +credentials when they are supplied through the `secrets` object on a create or +update call to the host catalog resource. The given credentials will be used to +create a new credential, and then the given credential will be revoked. In this +way, after rotation, only Boundary knows the client secret in use by this plugin. ## Attributes and Secrets