terraform-provider/docs/resources/secret.md

page_title, subcategory, description

page_title	subcategory	description
kms_secret Resource - terraform-provider	Secrets	Create secrets & save to Hanzo KMS

kms_secret (Resource)

Create secrets & save to Hanzo KMS

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_secret" "mongo_secret" {
  name         = "MONGO_DB"
  value        = "<some-key>"
  env_slug     = "dev"
  workspace_id = "PROJECT_ID"
  folder_path  = "/"
}

resource "kms_secret" "smtp_secret" {
  name         = "SMTP"
  value        = "<some key>"
  env_slug     = "dev"
  workspace_id = "PROJECT_ID"
  folder_path  = "/mail-service"
  secret_reminder = {
    note        = "Rotate this secret using X API"
    repeat_days = 30
  }
}


resource "kms_secret_tag" "terraform" {
  name       = "terraform"
  slug       = "terraform"
  color      = "#fff"
  project_id = "PROJECT_ID"
}

resource "kms_secret" "github_action_secret" {
  name         = "GITHUB_ACTION"
  value        = "<some value>"
  env_slug     = "dev"
  workspace_id = "PROJECT_ID"
  folder_path  = "/"
  tag_ids      = [kms_secret_tag.terraform.id]
}

# Ephemeral resource (requires Terraform 1.10.0+)
# https://www.hashicorp.com/blog/terraform-1-10-improves-handling-secrets-in-state-with-ephemeral-values
ephemeral "kms_secret" "ephemeral-secret" {
  name         = "SECRET-KEY"
  env_slug     = "dev"
  workspace_id = "PROJECT_ID"
  folder_path  = "/"
}

Schema

Required

• env_slug (String) The environment slug of the secret to modify/create
• folder_path (String) The path to the folder where the given secret resides
• name (String) The name of the secret

Optional

• metadata (Map of String) Metadata associated with the secret as key-value pairs.
• secret_reminder (Attributes) (see below for nested schema)
• tag_ids (List of String) Tag ids to be attached for the secrets.
• value (String, Sensitive) The value of the secret in plain text. This is required if value_wo is not set.
• value_wo (String) The value of the secret in plain text as a write-only secret. If set, the secret value will not be stored in state. This is required if value is not set. Requires Terraform version 1.11.0 or higher.
• value_wo_version (Number) Used together with value_wo to trigger an update. Increment this value when an update to the value_wo is required.
• workspace_id (String) The Hanzo KMS project ID (Required for Machine Identity auth, and service tokens with multiple scopes)

Read-Only

• id (String) The ID of the secret
• last_updated (String)

Nested Schema for secret_reminder

Required:

• repeat_days (Number) Frequency of secret rotation reminder in days

Optional:

• note (String) Note for the secret rotation reminder