terraform-provider/docs/ephemeral-resources/secret.md

page_title, subcategory, description

page_title	subcategory	description
kms_secret Ephemeral Resource - terraform-provider	Secrets	Read ephemeral secrets from Hanzo KMS

kms_secret (Ephemeral Resource)

Read ephemeral secrets from Hanzo KMS

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
    postgresql = {
      source  = "cyrilgdn/postgresql"
      version = "1.25.0"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

ephemeral "kms_secret" "postgres_username" {
  name         = "POSTGRES_USERNAME"
  env_slug     = "dev"
  workspace_id = "PROJECT_ID"
  folder_path  = "/"
}

ephemeral "kms_secret" "postgres_password" {
  name         = "POSTGRES_PASSWORD"
  env_slug     = "dev"
  workspace_id = "PROJECT_ID"
  folder_path  = "/"
}

locals {
  credentials = {
    username = ephemeral.kms_secret.postgres_username.value
    password = ephemeral.kms_secret.postgres_password.value
  }
}

provider "postgresql" {
  host     = data.aws_db_instance.example.address
  port     = data.aws_db_instance.example.port
  username = local.credentials["username"]
  password = local.credentials["password"]
}

Schema

Required

• env_slug (String) The environment slug of the secret to fetch
• folder_path (String) The path to the folder where the given secret resides
• name (String) The name of the secret
• workspace_id (String) The Hanzo KMS project ID

Read-Only

• metadata (Map of String) Metadata associated with the secret as key-value pairs.
• value (String, Sensitive) The value of the secret