allow dynamic credentials for storage buckets

docs/resources/storage_bucket.md

@@ -21,8 +21,8 @@ resource "boundary_scope" "org" {
   auto_create_default_role = true
 }
 
-resource "boundary_storage_bucket" "aws_example" {
-  name            = "My aws storage bucket"
+resource "boundary_storage_bucket" "aws_static_credentials_example" {
+  name            = "My aws storage bucket with static credentials"
   description     = "My first storage bucket!"
   scope_id        = boundary_scope.org.id
   plugin_name     = "aws"
@@ -37,6 +37,22 @@ resource "boundary_storage_bucket" "aws_example" {
   })
   worker_filter = "\"pki\" in \"/tags/type\""
 }
+
+resource "boundary_storage_bucket" "aws_dynamic_credentials_example" {
+  name            = "My aws storage bucket with dynamic credentials"
+  description     = "My first storage bucket!"
+  scope_id        = boundary_scope.org.id
+  plugin_name     = "aws"
+  bucket_name     = "mybucket"
+
+  # the role_arn value should be the same arn used as the instance profile that is attached to the ec2 instance
+  # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html
+  attributes_json = jsonencode({
+    "region" = "us-east-1" 
+    "role_arn" = "arn:aws:iam::123456789012:role/S3Access"
+  })
+  worker_filter = "\"pki\" in \"/tags/type\""
+}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -46,7 +62,6 @@ resource "boundary_storage_bucket" "aws_example" {
 
 - `bucket_name` (String) The name of the bucket within the external object store service.
 - `scope_id` (String) The scope for this storage bucket.
-- `secrets_json` (String, Sensitive) The secrets for the storage bucket. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing this block will NOT clear secrets from the storage bucket; this allows injecting secrets for one call, then removing them for storage.
 - `worker_filter` (String) Filters to the worker(s) that can handle requests for this storage bucket. The filter must match an existing worker in order to create a storage bucket.
 
 ### Optional
@@ -57,6 +72,7 @@ resource "boundary_storage_bucket" "aws_example" {
 - `name` (String) The storage bucket name. Defaults to the resource name.
 - `plugin_id` (String) The ID of the plugin that should back the resource. This or plugin_name must be defined.
 - `plugin_name` (String) The name of the plugin that should back the resource. This or plugin_id must be defined.
+- `secrets_json` (String, Sensitive) The secrets for the storage bucket. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing this block will NOT clear secrets from the storage bucket; this allows injecting secrets for one call, then removing them for storage.
 
 ### Read-Only
 

examples/resources/boundary_storage_bucket/resource.tf

@@ -6,8 +6,8 @@ resource "boundary_scope" "org" {
   auto_create_default_role = true
 }
 
-resource "boundary_storage_bucket" "aws_example" {
-  name            = "My aws storage bucket"
+resource "boundary_storage_bucket" "aws_static_credentials_example" {
+  name            = "My aws storage bucket with static credentials"
   description     = "My first storage bucket!"
   scope_id        = boundary_scope.org.id
   plugin_name     = "aws"
@@ -22,3 +22,19 @@ resource "boundary_storage_bucket" "aws_example" {
   })
   worker_filter = "\"pki\" in \"/tags/type\""
 }
+
+resource "boundary_storage_bucket" "aws_dynamic_credentials_example" {
+  name            = "My aws storage bucket with dynamic credentials"
+  description     = "My first storage bucket!"
+  scope_id        = boundary_scope.org.id
+  plugin_name     = "aws"
+  bucket_name     = "mybucket"
+
+  # the role_arn value should be the same arn used as the instance profile that is attached to the ec2 instance
+  # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html
+  attributes_json = jsonencode({
+    "region" = "us-east-1" 
+    "role_arn" = "arn:aws:iam::123456789012:role/S3Access"
+  })
+  worker_filter = "\"pki\" in \"/tags/type\""
+}

internal/provider/resource_storage_bucket.go

@@ -82,7 +82,7 @@ func resourceStorageBucket() *schema.Resource {
 					`or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing ` +
 					`this block will NOT clear secrets from the storage bucket; this allows injecting secrets for one call, then removing them for storage.`,
 				Type:      schema.TypeString,
-				Required:  true,
+				Optional:  true,
 				Sensitive: true,
 			},
 			SecretsHmacKey: {