terraform-provider/docs/resources/secret_sync_aws_parameter_store.md

page_title, subcategory, description

page_title	subcategory	description
kms_secret_sync_aws_parameter_store Resource - terraform-provider	Secret Syncs	Create and manage AWS Parameter Store secret syncs

kms_secret_sync_aws_parameter_store (Resource)

Create and manage AWS Parameter Store secret syncs

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_secret_sync_aws_parameter_store" "aws-parameter-store-secret-sync" {
  name          = "aws-parameter-store-secret-sync-demo"
  description   = "Demo of AWS Parameter Store secret sync"
  project_id    = "<project-id>"
  environment   = "<environment-slug>"
  secret_path   = "<secret-path>" # Root folder is /
  connection_id = "<app-connection-id>"

  sync_options = {
    initial_sync_behavior        = "overwrite-destination", # Supported options: overwrite-destination, import-prioritize-source, import-prioritize-destination
    aws_kms_key_id               = "<aws-kms-key-id>",
    sync_secret_metadata_as_tags = false,
    tags = [
      {
        key   = "tag-1"
        value = "tag-1-value"
      },
      {
        key   = "tag-2"
        value = "tag-2-value"
      },
    ]
  }

  destination_config = {
    aws_region = "<aws-region>" # E.g us-east-1
    path       = "/example/secrets/"
  }
}

Schema

Required

• connection_id (String) The ID of the aws Connection to use for syncing.
• destination_config (Attributes) The destination configuration for the secret sync. (see below for nested schema)
• environment (String) The slug of the project environment to sync secrets from.
• name (String) The name of the AWS Parameter Store sync to create. Must be slug-friendly.
• project_id (String) The ID of the Hanzo KMS project to create the sync in.
• secret_path (String) The folder path to sync secrets from.
• sync_options (Attributes) Parameters to modify how secrets are synced. (see below for nested schema)

Optional

• auto_sync_enabled (Boolean) Whether secrets should be automatically synced when changes occur at the source location or not.
• description (String) An optional description for the AWS Parameter Store sync.

Read-Only

• id (String) The ID of the AWS Parameter Store secret sync

Nested Schema for destination_config

Required:

• aws_region (String) The AWS region of your AWS Parameter Store
• path (String) The path in the AWS Parameter Store where the secrets will be stored, Example: /example/path/

Nested Schema for sync_options

Required:

• initial_sync_behavior (String) Specify how Hanzo KMS should resolve the initial sync to the destination. Supported options: overwrite-destination, import-prioritize-source, import-prioritize-destination

Optional:

• aws_kms_key_id (String) The AWS KMS key ID to use for encryption
• disable_secret_deletion (Boolean) When set to true, Hanzo KMS will not remove secrets from AWS Parameter Store. Enable this option if you intend to manage some secrets manually outside of Hanzo KMS.
• key_schema (String) The format to use for structuring secret keys in the AWS Parameter Store destination.
• sync_secret_metadata_as_tags (Boolean) Whether to sync the secret metadata as tags
• tags (Attributes Set) The tags to sync to the secret (see below for nested schema)

Nested Schema for sync_options.tags

Required:

• key (String) The key of the tag
• value (String) The value of the tag