terraform-provider/docs/resources/secret_sync_aws_secrets_manager.md

page_title, subcategory, description

page_title	subcategory	description
kms_secret_sync_aws_secrets_manager Resource - terraform-provider	Secret Syncs	Create and manage AWS Secrets Manager secret syncs

kms_secret_sync_aws_secrets_manager (Resource)

Create and manage AWS Secrets Manager secret syncs

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_secret_sync_aws_secrets_manager" "aws-secrets-manager-secret-sync" {
  name          = "aws-secrets-manager-secret-sync-demo"
  description   = "Demo of AWS Secrets Manager secret sync"
  project_id    = "<project-id>"
  environment   = "<environment-slug>"
  secret_path   = "<secret-path>" # Root folder is /
  connection_id = "<app-connection-id>"

  sync_options = {
    initial_sync_behavior        = "overwrite-destination", # Supported options: overwrite-destination, import-prioritize-source, import-prioritize-destination
    aws_kms_key_id               = "<aws-kms-key-id>",
    sync_secret_metadata_as_tags = false,
    tags = [
      {
        key   = "tag-1"
        value = "tag-1-value"
      },
      {
        key   = "tag-2"
        value = "tag-2-value"
      },
    ]
  }

  destination_config = {
    aws_region                      = "<aws-region>"      # E.g us-east-1
    mapping_behavior                = "many-to-one"       # Supported options: many-to-one, one-to-one
    aws_secrets_manager_secret_name = "<aws-secret-name>" # Only required when mapping behavior is 'many-to-one'
  }
}

Schema

Required

• connection_id (String) The ID of the aws Connection to use for syncing.
• destination_config (Attributes) The destination configuration for the secret sync. (see below for nested schema)
• environment (String) The slug of the project environment to sync secrets from.
• name (String) The name of the AWS Secrets Manager sync to create. Must be slug-friendly.
• project_id (String) The ID of the Hanzo KMS project to create the sync in.
• secret_path (String) The folder path to sync secrets from.
• sync_options (Attributes) Parameters to modify how secrets are synced. (see below for nested schema)

Optional

• auto_sync_enabled (Boolean) Whether secrets should be automatically synced when changes occur at the source location or not.
• description (String) An optional description for the AWS Secrets Manager sync.

Read-Only

• id (String) The ID of the AWS Secrets Manager secret sync

Nested Schema for destination_config

Required:

• aws_region (String) The AWS region of your AWS Secrets Manager

Optional:

• aws_secrets_manager_secret_name (String) The name of the AWS secret to map to. This only applies when mapping_behavior is set to 'many-to-one'.
• mapping_behavior (String) The behavior of the mapping. Can be 'many-to-one' or 'one-to-one'. Many to One: All Hanzo KMS secrets will be mapped to a single AWS secret. One to One: Each Hanzo KMS secret will be mapped to its own AWS secret.

Nested Schema for sync_options

Required:

• initial_sync_behavior (String) Specify how Hanzo KMS should resolve the initial sync to the destination. Supported options: overwrite-destination, import-prioritize-source, import-prioritize-destination

Optional:

• aws_kms_key_id (String) The AWS KMS key ID to use for encryption
• disable_secret_deletion (Boolean) When set to true, Hanzo KMS will not remove secrets from AWS Secrets Manager. Enable this option if you intend to manage some secrets manually outside of Hanzo KMS.
• key_schema (String) The format to use for structuring secret keys in the AWS Secrets Manager destination.
• sync_secret_metadata_as_tags (Boolean) Whether to sync the secret metadata as tags. This is only supported for the 'one-to-one' mapping behavior.
• tags (Attributes Set) The tags to sync to the secret (see below for nested schema)

Nested Schema for sync_options.tags

Required:

• key (String) The key of the tag
• value (String) The value of the tag