packer-plugin/docs/datasources/secrets.md

The Secrets data source displays secrets within an Hanzo KMS folder.

-> Note: Data sources is a feature exclusively available to HCL2 templates.

Basic examples of usage:

data "kms-secrets" "dev-secrets" {
  folder_path = "/"
  env_slug    = "dev"
  project_id  = "00000000-0000-0000-0000-000000000000"

  universal_auth {
    client_id = "00000000-0000-0000-0000-000000000000"
    client_secret = "..."
  }
}

# usage example of the data source output
locals {
  secrets = data.kms-secrets.dev-secrets.secrets
  secret_foo_value  = secrets["FOO"].secret_value
}

Configuration Reference

Required

• project_id (string) - The project to list secrets from.

• env_slug (string) - The environment to list secrets from. (e.g. dev, staging, prod)

Optional

• host (string) - The host URL of your Hanzo KMS instance. If a value isn't provided, KMS_HOST may be used. Default: https://kms.hanzo.ai

• folder_path (string) - The secret path to list secrets from. Default: /

• universal_auth (UniversalAuth) - Configuration for Hanzo KMS Universal Authentication.

Universal Auth Object

Required:

• client_id (string) - The Client ID for Hanzo KMS Universal Authentication.

Optional:

• client_secret (string) - The Client Secret for Hanzo KMS Universal Authentication. You may use KMS_UNIVERSAL_AUTH_CLIENT_SECRET env variable instead.

Output Data

Returned secrets are in key/object pairs. Each Secret object contains data about the secret such as it's value, version, and type.

• secrets (map[string]Secret) - Secrets

Secret Object

• version (int) - Version

• workspace (string) - Workspace

• type (string) - Type

• environment (string) - Environment

• secret_key (string) - Secret Key

• secret_value (string) - Secret Value

• secret_comment (string) - Secret Comment

Authentication

Basic example of an Hanzo KMS Secrets data source authentication using universal auth:

data "kms-secrets" "dev-secrets" {
  folder_path = "/"
  env_slug    = "dev"
  project_id  = "00000000-0000-0000-0000-000000000000"

  universal_auth {
    client_id = "00000000-0000-0000-0000-000000000000"
    client_secret = "..."
  }
}

client_secret may be left blank if you're using the KMS_UNIVERSAL_AUTH_CLIENT_SECRET environment variable.