terraform-provider/docs/resources/secret_sync_azure_key_vault.md

page_title, subcategory, description

page_title	subcategory	description
kms_secret_sync_azure_key_vault Resource - terraform-provider	Secret Syncs	Create and manage Azure Key Vault secret syncs

kms_secret_sync_azure_key_vault (Resource)

Create and manage Azure Key Vault secret syncs

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_secret_sync_azure_key_vault" "app-configuration-demo" {
  name          = "demo-sync"
  description   = "This is a demo sync."
  project_id    = "<project-id>"
  environment   = "dev"
  secret_path   = "/"
  connection_id = "<app-connection-id>" # The ID of your Azure App Connection

  sync_options = {
    initial_sync_behavior = "overwrite-destination"
  }
  destination_config = {
    vault_base_url = "<vault-base-url>", # https://example.vault.azure.net/
  }
}

Schema

Required

• connection_id (String) The ID of the azure Connection to use for syncing.
• destination_config (Attributes) The destination configuration for the secret sync. (see below for nested schema)
• environment (String) The slug of the project environment to sync secrets from.
• name (String) The name of the Azure Key Vault sync to create. Must be slug-friendly.
• project_id (String) The ID of the Hanzo KMS project to create the sync in.
• secret_path (String) The folder path to sync secrets from.
• sync_options (Attributes) Parameters to modify how secrets are synced. (see below for nested schema)

Optional

• auto_sync_enabled (Boolean) Whether secrets should be automatically synced when changes occur at the source location or not.
• description (String) An optional description for the Azure Key Vault sync.

Read-Only

• id (String) The ID of the Azure Key Vault secret sync

Nested Schema for destination_config

Required:

• vault_base_url (String) The base URL of your Azure Key Vault

Nested Schema for sync_options

Required:

• initial_sync_behavior (String) Specify how Hanzo KMS should resolve the initial sync to the destination. Supported options: overwrite-destination, import-prioritize-source, import-prioritize-destination

Optional:

• disable_secret_deletion (Boolean) When set to true, Hanzo KMS will not remove secrets from Azure Key Vault. Enable this option if you intend to manage some secrets manually outside of Hanzo KMS.
• key_schema (String) The format to use for structuring secret keys in the Azure Key Vault destination.