terraform-provider/docs/resources/dynamic_secret_sql_database.md

page_title, subcategory, description

page_title	subcategory	description
kms_dynamic_secret_sql_database Resource - terraform-provider	Dynamic Secrets	Create and manage SQL Database Dynamic Secret

kms_dynamic_secret_sql_database (Resource)

Create and manage SQL Database Dynamic Secret

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_dynamic_secret_sql_database" "sql-database" {
  name             = "postgres-dynamic-secret"
  project_slug     = "project-7-new-c7-vv"
  environment_slug = "prod"
  path             = "/"
  default_ttl      = "2h"
  max_ttl          = "4h"

  configuration = {
    client             = "postgres"
    host               = "host.docker.internal"
    port               = "5431"
    database           = "kms"
    username           = "kms"
    password           = "kms"
    creation_statement = <<-EOT
      CREATE USER "{{username}}" WITH ENCRYPTED PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';
      GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "{{username}}";
    EOT

    revocation_statement = <<-EOT
      REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM "{{username}}";
      DROP ROLE "{{username}}";
    EOT

    renew_statement = <<-EOT
      ALTER ROLE "{{username}}" VALID UNTIL "{{expiration}}";
    EOT

    password_requirements = {
      length = 32
      required = {
        digits    = 3
        lowercase = 2
        symbols   = 2
        uppercase = 2
      }
      allowed_symbols = "!@#$%^&*()_+-=[]{}|:,.<>?`~"
    }

  }

  username_template = "{{randomUsername}}"
}

Schema

Required

• configuration (Attributes) The configuration of the dynamic secret (see below for nested schema)
• default_ttl (String) The default TTL that will be applied for all the leases.
• environment_slug (String) The slug of the environment to create the dynamic secret in.
• name (String) The name of the dynamic secret.
• path (String) The path to create the dynamic secret in.
• project_slug (String) The slug of the project to create dynamic secret in.

Optional

• max_ttl (String) The maximum limit a TTL can be leased or renewed for.
• metadata (Attributes Set) The metadata associated with this dynamic secret (see below for nested schema)
• username_template (String) The username template of the dynamic secret

Read-Only

• id (String) The ID of the dynamic secret.

Nested Schema for configuration

Required:

• client (String) The database client to use. Currently supported values are postgres, mysql2, oracledb, mssql, sap-ase, and vertica.
• creation_statement (String) The creation statement to use to create the dynamic secret lease.
• database (String) The name of the database to use.
• host (String) The host of the database server.
• password (String, Sensitive) The password to use to connect to the database.
• port (Number) The port of the database server.
• revocation_statement (String) The revocation statement to use to revoke the dynamic secret lease.
• username (String) The username to use to connect to the database.

Optional:

• ca (String) The CA certificate to use to connect to the database.
• gateway_id (String) The Gateway ID to use to connect to the database.
• password_requirements (Attributes) The password requirements to use to create the dynamic secret lease. (see below for nested schema)
• renew_statement (String) The renew statement to use to renew the dynamic secret lease.

Nested Schema for configuration.password_requirements

Required:

• length (Number) The length of the password to use to create the dynamic secret lease.
• required (Attributes) The required characters to use to create the dynamic secret lease. (see below for nested schema)

Optional:

• allowed_symbols (String) The symbols allowed in the password.

Nested Schema for configuration.password_requirements.required

Required:

• digits (Number) The number of digits required in the password.
• lowercase (Number) The number of lowercase characters required in the password.
• symbols (Number) The number of symbols required in the password.
• uppercase (Number) The number of uppercase characters required in the password.

Nested Schema for metadata

Required:

• key (String) The key of the metadata object
• value (String) The value of the metadata object