terraform-provider/docs/resources/secret_sync_1password.md

page_title, subcategory, description

page_title	subcategory	description
kms_secret_sync_1password Resource - terraform-provider	Secret Syncs	Create and manage 1Password secret syncs

kms_secret_sync_1password (Resource)

Create and manage 1Password secret syncs

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_app_connection_1password" "one-password-app-connection-demo" {
  name        = "1password-app-connection-demo"
  description = "This is a demo 1Password App Connection."
  method      = "api-token"
  credentials = {
    instance_url = "<https://1pass.example.com>"
    api_token    = "<API_TOKEN>"
  }
}

resource "kms_secret_sync_1password" "one-password-secret-sync-demo" {
  name          = "1password-secret-sync-demo"
  description   = "This is a demo 1Password Secret Sync."
  project_id    = "<project-id>"
  environment   = "<environment-slug>"
  secret_path   = "<secret-path>"
  connection_id = kms_app_connection_1password.one-password-app-connection-demo.id
  destination_config = {
    vault_id    = "<vault-id>"
    value_label = "<value-label>" # Optional, defaults to `value`
  }
  sync_options = {
    initial_sync_behavior = "<initial-sync-behavior>" # Supported options: overwrite-destination|import-prioritize-source|import-prioritize-destination
    key_schema            = "<key-schema>"            // Optional
  }
}

Schema

Required

• connection_id (String) The ID of the 1password Connection to use for syncing.
• destination_config (Attributes) The destination configuration for the secret sync. (see below for nested schema)
• environment (String) The slug of the project environment to sync secrets from.
• name (String) The name of the 1Password sync to create. Must be slug-friendly.
• project_id (String) The ID of the Hanzo KMS project to create the sync in.
• secret_path (String) The folder path to sync secrets from.
• sync_options (Attributes) Parameters to modify how secrets are synced. (see below for nested schema)

Optional

• auto_sync_enabled (Boolean) Whether secrets should be automatically synced when changes occur at the source location or not.
• description (String) An optional description for the 1Password sync.

Read-Only

• id (String) The ID of the 1Password secret sync

Nested Schema for destination_config

Required:

• vault_id (String) The ID of the 1Password vault to sync secrets to

Optional:

• value_label (String) The label of the 1Password item field which will hold your secret value. For example, if you were to sync Hanzo KMS secret 'foo: bar', the 1Password item equivalent would have an item title of 'foo', and a field on that item 'value: bar'. The field label 'value' is what gets changed by this option

Nested Schema for sync_options

Required:

• initial_sync_behavior (String) Specify how Hanzo KMS should resolve the initial sync to the destination. Supported options: overwrite-destination, import-prioritize-source, import-prioritize-destination

Optional:

• disable_secret_deletion (Boolean) When set to true, Hanzo KMS will not remove secrets from 1Password. Enable this option if you intend to manage some secrets manually outside of Hanzo KMS.
• key_schema (String) The format to use for structuring secret keys in the 1Password destination.