terraform-provider/docs/resources/secret_sync_gcp_secret_manager.md

page_title, subcategory, description

page_title	subcategory	description
kms_secret_sync_gcp_secret_manager Resource - terraform-provider	Secret Syncs	Create and manage GCP Secret Manager secret syncs

kms_secret_sync_gcp_secret_manager (Resource)

Create and manage GCP Secret Manager secret syncs

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_app_connection_gcp" "app-connection-gcp" {
  name   = "gcp-app-connect"
  method = "service-account-impersonation"
  credentials = {
    service_account_email = "service-account-df92581a-0fe9@my-duplicate-project.iam.gserviceaccount.com"
  }
  description = "I am a test app connection"
}

resource "kms_secret_sync_gcp_secret_manager" "secret_manager_test" {
  name          = "gcp-sync-tests"
  description   = "I am a test secret sync"
  project_id    = "f4517f4c-8b61-4727-8aef-5ae2807126fb"
  environment   = "prod"
  secret_path   = "/"
  connection_id = kms_app_connection_gcp.app-connection-gcp.id

  sync_options = {
    initial_sync_behavior = "import-prioritize-destination"
  }
  destination_config = {
    project_id = "my-duplicate-project"
  }
}

Schema

Required

• connection_id (String) The ID of the GCP Connection to use for syncing.
• destination_config (Attributes) The destination configuration for the secret sync. (see below for nested schema)
• environment (String) The slug of the project environment to sync secrets from.
• name (String) The name of the GCP Secret Manager sync to create. Must be slug-friendly.
• project_id (String) The ID of the Hanzo KMS project to create the sync in.
• secret_path (String) The folder path to sync secrets from.
• sync_options (Attributes) Parameters to modify how secrets are synced. (see below for nested schema)

Optional

• auto_sync_enabled (Boolean) Whether secrets should be automatically synced when changes occur at the source location or not.
• description (String) An optional description for the GCP Secret Manager sync.

Read-Only

• id (String) The ID of the GCP Secret Manager secret sync

Nested Schema for destination_config

Required:

• project_id (String) The ID of the GCP project to sync with

Optional:

• scope (String) The scope of the sync with GCP Secret Manager. Supported options: global

Nested Schema for sync_options

Required:

• initial_sync_behavior (String) Specify how Hanzo KMS should resolve the initial sync to the destination. Supported options: overwrite-destination, import-prioritize-source, import-prioritize-destination

Optional:

• disable_secret_deletion (Boolean) When set to true, Hanzo KMS will not remove secrets from GCP Secret Manager. Enable this option if you intend to manage some secrets manually outside of Hanzo KMS.
• key_schema (String) The format to use for structuring secret keys in the GCP Secret Manager destination.