Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow Vault to make updates to the DynamoDB table it creates #25114

Closed
michael-diggin opened this issue Jan 29, 2024 · 1 comment
Closed

Allow Vault to make updates to the DynamoDB table it creates #25114

michael-diggin opened this issue Jan 29, 2024 · 1 comment

Comments

@michael-diggin
Copy link
Contributor

Is your feature request related to a problem? Please describe.
When Vault is set up to use DynamoDB as the storage backend, it will create the table if it doesn't exist and will no-op if it does exist.
It would be nice if Vault could make updates to the table, to change the provisioned throughput or the billing mode (ie from provisioned to pay-per-request).

Describe the solution you'd like
Along with the settings and environment variables for read_capacity and write_capacity, there could be two more: billing_mode and allow_updates. Billing mode specifies if the table is provisioned, or pay-per-request. If allow_updates is set, then Vault would check if the existing table differs from the provided values, and if it does, Vault makes an UpdateTable API call.
The defaults of these would retain the existing behaviour (billing mode of provisioned, and a no-op if the table already exists).

Describe alternatives you've considered
The only other alternative is to manage the dynamo table in Terraform (or some other way) and continue to have Vault no-op when the table exists.

Explain any additional use-cases
We've got several Vault clusters running with DynamoDB, and in a desire to reduce some costs we've spotted that changing these tables to pay per request would be cheaper. Right now that means either manually making the change to the table, or importing the dynamodb table into a Terraform set up for every Vault cluster running. This is a bit of a pain as it requires access to every production cluster we have running.

Additional context
The DynamoDB storage backend is community supported so I'm more than happy to make the changes if this feature request is acceptable.

@jahantech
Copy link

Any update on this? We are also affected by this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants