Relax vault name validation

[aburgel]

Hi, I'm attempting to upgrade from 0.26 to the latest version and I'm running into an issue with the new vault name validations. My vault name contains one of the banned words, so it's failing the new validation which means I can't upgrade.

You can't change the name of a vault so there isn't much I can do about this, other than stay on the old version.

I think it's great that this module tries to protect you from bad naming, but it's a little too restrictive for those of us that already have a bad name.

Is it possible to change this? Maybe another variable like vault_name_validation_opt_out where you can selectively disable this rule.

Thank you for making this module, it's been super helpful.

[lgallard]

@claude let's address this issue

[claude]

Claude finished @lgallard's task —— View job • claude/issue-292-20251103-0920 • Create PR ➔

---

Task Breakdown

• Analyze current vault name validation logic
• Implement opt-out mechanism for vault name validation
• Test the implementation locally
• Commit and push changes
• Provide PR creation link

Analysis

I found the restrictive vault name validation on lines 9-16 in variables.tf. The validation currently prevents vault names containing words like "test", "temp", "delete", "remove", or "default". This is causing upgrade issues for users with existing vaults that have these names.

Implementation

I implemented a new variable vault_name_validation_bypass that allows users to disable the strict word checking while maintaining the basic format validation (length, character restrictions). The solution:

1. New Variable: vault_name_validation_bypass (boolean, defaults to false)
2. Modified Validation: The word validation now only applies when bypass is false
3. Backward Compatibility: Existing users won't see any changes unless they explicitly set the bypass flag
4. Format Validation Preserved: The basic vault naming requirements (2-50 chars, alphanumeric + hyphens/underscores) remain enforced

Usage

For users with existing vaults containing banned words:

module "backup" {
  source = "..."
  
  vault_name = "my-test-vault"  # Previously would fail
  vault_name_validation_bypass = true  # New flag to allow this
  
  # ... other configuration
}

Changes Made

• variables.tf: Added vault_name_validation_bypass variable and updated vault_name validation logic
• Documentation: Will be automatically updated by terraform-docs during CI

The changes have been committed and pushed to the branch. The solution addresses the issue while maintaining security best practices by requiring explicit opt-out.

---

[lgallard]

@aburgel the latest release has your suggested bypass. Thanks for reporting and sharing your idea on how to handle it!