terraform-provider/docs/index.md

page_title, subcategory, description

page_title	subcategory	description
kms Provider		This provider allows you to interact with Hanzo KMS

kms Provider

This provider allows you to interact with Hanzo KMS

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    # organization_slug = "<organization slug to scope the session to sub-org>"
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

Schema

Optional

• auth (Attributes) The configuration values for authentication (see below for nested schema)
• client_id (String, Sensitive) (DEPRECATED, Use the auth attribute), Machine identity client ID. Used to fetch/modify secrets for a given project.
• client_secret (String, Sensitive) (DEPRECATED, use auth attribute), Machine identity client secret. Used to fetch/modify secrets for a given project
• host (String) Used to point the client to fetch secrets from your self hosted instance of Hanzo KMS. If not host is provided, https://kms.hanzo.ai is the default host. This attribute can also be set using the KMS_HOST environment variable
• service_token (String, Sensitive) (DEPRECATED, Use machine identity auth), Used to fetch/modify secrets for a given project

Nested Schema for auth

Optional:

• aws_iam (Attributes) The configuration values for AWS IAM Auth (see below for nested schema)
• kubernetes (Attributes) The configuration values for Kubernetes Auth (see below for nested schema)
• oidc (Attributes) The configuration values for OIDC Auth (see below for nested schema)
• organization_slug (String) When set, this will scope the login session to the specified organization the machine identity has access to. If left empty, the session defaults to the organization where the machine identity was created in.
• token (String, Sensitive) The authentication token for Machine Identity Token Auth. This attribute can also be set using the KMS_TOKEN environment variable
• universal (Attributes) The configuration values for Universal Auth (see below for nested schema)

Nested Schema for auth.aws_iam

Optional:

• identity_id (String, Sensitive) Machine identity ID. This attribute can also be set using the KMS_MACHINE_IDENTITY_ID environment variable

Nested Schema for auth.kubernetes

Optional:

• identity_id (String, Sensitive) Machine identity ID. This attribute can also be set using the KMS_MACHINE_IDENTITY_ID environment variable
• service_account_token (String, Sensitive) The service account token. This attribute can also be set using the KMS_KUBERNETES_SERVICE_ACCOUNT_TOKEN environment variable
• service_account_token_path (String) The path to the service account token. This attribute can also be set using the KMS_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH environment variable. Default is /var/run/secrets/kubernetes.io/serviceaccount/token.

Nested Schema for auth.oidc

Optional:

• identity_id (String, Sensitive) Machine identity ID. This attribute can also be set using the KMS_MACHINE_IDENTITY_ID environment variable
• token_environment_variable_name (String) The environment variable name for the OIDC JWT token. This attribute can also be set using the KMS_OIDC_AUTH_TOKEN_KEY_NAME environment variable. Default is KMS_AUTH_JWT.

Nested Schema for auth.universal

Optional:

• client_id (String, Sensitive) Machine identity client ID. This attribute can also be set using the KMS_UNIVERSAL_AUTH_CLIENT_ID environment variable
• client_secret (String, Sensitive) Machine identity client secret. This attribute can also be set using the KMS_UNIVERSAL_AUTH_CLIENT_SECRET environment variable