auth_approle_terraform_incus.tf

@@ -0,0 +1,15 @@
+resource "vault_approle_auth_backend_role" "terraform_incus" {
+  role_name      = "terraform_incus"
+  bind_secret_id = false
+  token_policies = [
+    "default_access",
+    "incus",
+  ]
+  token_ttl     = 60
+  token_max_ttl = 120
+  token_bound_cidrs = [
+    "10.10.12.200/32",
+    "198.18.13.67/32",
+    "198.18.13.68/32",
+  ]
+}

policies/kv/service/terraform/incus.hcl

@@ -0,0 +1,3 @@
+path "kv/data/service/terraform/incus" {
+    capabilities = ["read"]
+}