RabbitMQ database plugin HTTP API

The RabbitMQ database plugin is one of the supported plugins for the database secrets engine. This plugin generates RabbitMQ user credentials dynamically based on configured roles for the RabbitMQ management API.

Configure connection

In addition to the parameters defined by the Database Backend, this plugin has a number of parameters to further configure a connection.

Method	Path
POST	/database/config/:name

Parameters

• connection_uri (string: <required>) – Specifies the RabbitMQ management URI, e.g. http://localhost:15672.

• username (string: <required>) – Specifies the RabbitMQ management administrator username. This account must carry the administrator tag to manage other users.

• password (string: <required>) – Specifies the RabbitMQ management administrator password.

• username_template (string) - Template describing how dynamic usernames are generated.

• tls_ca (string: "") – Specifies a PEM-encoded CA certificate bundle used to verify the RabbitMQ management API's TLS certificate.

• tls_certificate (string: "") – Specifies a PEM-encoded client certificate used for mutual TLS to the RabbitMQ management API. Requires tls_key to also be set.

• tls_key (string: "") – Specifies the PEM-encoded private key for tls_certificate.

• insecure (bool: false) – Skips TLS certificate verification when connecting to the RabbitMQ management API. Not recommended outside of development.

Sample payload

{
  "plugin_name": "rabbitmq-database-plugin",
  "allowed_roles": "my-role",
  "connection_uri": "http://localhost:15672",
  "username": "admin",
  "password": "password"
}

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/database/config/rabbitmq

Statements

Unlike SQL-based plugins, this plugin's creation_statements is a single JSON role document rather than a list of SQL statements. It is configured during role creation and used by the plugin to determine what tags and permissions are granted on user creation. For more information on configuring roles see the Role API in the database secrets engine docs.

Parameters

• creation_statements (string: <required>) – A JSON document describing the tags and permissions to grant the generated user:

  {
    "tags": "administrator",
    "vhosts": {
      "/": { "configure": ".*", "write": ".*", "read": ".*" }
    },
    "vhost_topics": {
      "/": {
        "amq.topic": { "write": ".*", "read": ".*" }
      }
    }
  }

  • tags (string: "") – Comma-separated list of management tags to assign to the user, e.g. "administrator,management".

  • vhosts (map: {}) – Map of virtual host name to a {configure, write, read} object of RabbitMQ permission regexes.

  • vhost_topics (map: {}) – Map of virtual host name to a map of exchange name to a {write, read} object of topic permission regexes.

  At least one of tags or vhosts is required.

• revocation_statements, rollback_statements, renew_statements, rotation_statements – Not used by this plugin. RabbitMQ users are deleted directly via the management API on revocation, and RabbitMQ has no native credential expiration to roll back or renew.