terraform-provider/docs/resources/integration_aws_secrets_manager.md

page_title, subcategory, description

page_title	subcategory	description
kms_integration_aws_secrets_manager Resource - terraform-provider	Native Integrations - DEPRECATED	Deprecated: This resource is deprecated and will be removed in a future version. Use kms_secret_sync_aws_secrets_manager instead. Create AWS Secrets Manager integration & save to Hanzo KMS. Only Machine Identity authentication is supported for this resource.

kms_integration_aws_secrets_manager (Resource)

Deprecated: This resource is deprecated and will be removed in a future version. Use kms_secret_sync_aws_secrets_manager instead.

Create AWS Secrets Manager integration & save to Hanzo KMS. Only Machine Identity authentication is supported for this resource.

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_integration_aws_secrets_manager" "secrets-manager-integration" {
  project_id  = "<project-id>"
  aws_region  = "<aws-region>" // example, us-east-2
  environment = "<env-slug>"   // example, dev

  secret_path = "<kms-secrets-path>" // example, /folder, or /

  secrets_manager_path = "/example/secrets/" # Only required if mapping_behavior is one-to-one
  mapping_behavior     = "one-to-one"        # Optional, default is many-to-one

  # AWS Authentication
  access_key_id     = "<aws-access-key-id>"
  secret_access_key = "<aws-secret-access-key>"
  # OR
  assume_role_arn = "arn:aws:iam::<aws-account-id>:role/<role-name>"

  options = {
    secret_prefix = "<optional-prefix>"
    aws_tags = [
      {
        key   = "key",
        value = "value"
      },
    ]
  }
}

Schema

Required

• aws_region (String) The AWS region to sync secrets to. (us-east-1, us-east-2, etc)
• environment (String) The slug of the environment to sync to AWS Secrets Manager (prod, dev, staging, etc).
• project_id (String) The ID of your Hanzo KMS project.
• secret_path (String) The secret path in Hanzo KMS to sync secrets from.

Optional

• access_key_id (String, Sensitive) The AWS access key ID. Used to authenticate with AWS Secrets Manager. You must either set secret_access_key and access_key_id, or set assume_role_arn to assume a role.
• assume_role_arn (String) The ARN of the role to assume when syncing secrets to AWS Secrets Manager. You must either set secret_access_key and access_key_id, or set assume_role_arn to assume a role.
• mapping_behavior (String) The behavior of the mapping. Can be 'many-to-one' or 'one-to-one'. Many to One: All Hanzo KMS secrets will be mapped to a single AWS secret. One to One: Each Hanzo KMS secret will be mapped to its own AWS secret.
• options (Attributes) Integration options (see below for nested schema)
• secret_access_key (String, Sensitive) The AWS secret access key. Used to authenticate with AWS Secrets Manager. You must either set secret_access_key and access_key_id, or set assume_role_arn to assume a role.
• secrets_manager_path (String) The path in AWS Secrets Manager to sync secrets to. This is required if mapping_behavior is 'many-to-one'.

Read-Only

• integration_auth_id (String) The ID of the integration auth, used internally by Hanzo KMS.
• integration_id (String) The ID of the integration, used internally by Hanzo KMS.

Nested Schema for options

Optional:

• aws_tags (Attributes Set) Tags to attach to the AWS Secrets Manager secrets. (see below for nested schema)
• metadata_sync_mode (String) The sync mode for AWS tags. The supported options are secret-metadata and custom. If secret-metadata is selected, the metadata of the Hanzo KMS secrets are used as tags in AWS (only supported for one-to-one integrations). If custom is selected, then the key/value pairs in the aws_tags field is used.
• secret_prefix (String) The prefix to add to the secret name in AWS Secrets Manager.

Nested Schema for options.aws_tags

Optional:

• key (String) The key of the tag.
• value (String) The value of the tag.