Unable to run `terraform destroy` when configuring `okta` auth backend

[hashicorp]

Unable to run `terraform destroy` when configuring `okta` auth backend

[usererror]

@wjam Not sure if you're still looking for a solution here but I ran into the same exact problem with github auth. One pure tf solution that currently works is to use a null resource to do the configuration instead of a vault_generic_secret directly:

# main.tf of a module called null-write i use to get around this issue
resource "null_resource" "config" {
  triggers = {
    path = "${var.path}"
    data = "${var.data}"
  }

  provisioner "local-exec" {
    command = "echo '${var.data}' | vault write ${var.path} -"
  }
}

which you would use like so... (the data must be json, you can use the builtin jsonencode function along with the builtin list/map funcs to build the data properly)

# main.tf of a module using the null-write module to configure an auth backend
resource "vault_auth_backend" "backend" {
  type        = "${var.type}"
  path        = "${var.path}"
  description = "${var.description}"
}

# you could repeat this block numerous times to create multiple approle roles etc.
module "config" {
  source = "../null-write"
  
  path = "${var.config_path}"
  data = "${var.config_data}"
}

Unfortunately this is much less obvious than using the generic secret resource and many people are unfamiliar with null_resource. It would be nice if we could configure the auth backends directly in a cleaner way. It really comes down to just writing json data to a path, but some auth backends like approle may require more than one k=v configuration (multiple roles for example).