terraform-provider/docs/resources/secret_sync_github.md

page_title, subcategory, description

page_title	subcategory	description
kms_secret_sync_github Resource - terraform-provider	Secret Syncs	Create and manage Github secret syncs

kms_secret_sync_github (Resource)

Create and manage Github secret syncs

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_secret_sync_github" "example-github-secret-sync" {
  name          = "github-secret-sync-demo"
  description   = "Demo of Github secret sync"
  project_id    = "<project-id>"
  environment   = "<environment-slug>"
  secret_path   = "/" # Root folder is /
  connection_id = "<github-app-connection-id>"

  sync_options = {
    initial_sync_behavior   = "overwrite-destination", # Supported options: overwrite-destination
    disable_secret_deletion = false,
    key_schema              = "KMS_{{secretKey}}" # Optional, but recommended
  }

  destination_config = {
    scope            = "repository"                # Supported options: repository|organization|repository-environment
    repository_owner = "<github-repository-owner>" # The github organization name or github username for personal repositories
    repository_name  = "<github-repository-name>"  # The github repository name
  }
}

Schema

Required

• connection_id (String) The ID of the github Connection to use for syncing.
• destination_config (Attributes) The destination configuration for the secret sync. (see below for nested schema)
• environment (String) The slug of the project environment to sync secrets from.
• name (String) The name of the Github sync to create. Must be slug-friendly.
• project_id (String) The ID of the Hanzo KMS project to create the sync in.
• secret_path (String) The folder path to sync secrets from.
• sync_options (Attributes) Parameters to modify how secrets are synced. (see below for nested schema)

Optional

• auto_sync_enabled (Boolean) Whether secrets should be automatically synced when changes occur at the source location or not.
• description (String) An optional description for the Github sync.

Read-Only

• id (String) The ID of the Github secret sync

Nested Schema for destination_config

Required:

• scope (String) The scope to sync the secrets to, repository|organization

Optional:

• repository_environment (String) The environment to sync the secrets to, required if scope is repository-environment
• repository_name (String) The repository to sync the secrets to, required if scope is repository or repository-environment. This is only the name of the repository, without the repository owner included. As an example if you have a repository called Hanzo KMS/go-sdk, you would only need to provide go-sdk here.
• repository_owner (String) The owner of the Github repository, required if scope is repository, repository-environment, or organization. This is the organization name, or the username for personal repositories. As an example if you have a repository called Hanzo KMS/go-sdk, you would only need to provide Hanzo KMS here.
• selected_repository_ids (List of Number) The repository ids to sync the secrets to, required if scope is organization and the visibility field is set to selected
• visibility (String) The visibility of the Github repository, required if scope is organization. Accepted values are: all|private|selected

Nested Schema for sync_options

Required:

• initial_sync_behavior (String) Specify how Hanzo KMS should resolve the initial sync to the destination. Supported options: overwrite-destination

Optional:

• disable_secret_deletion (Boolean) When set to true, Hanzo KMS will not remove secrets from Github. Enable this option if you intend to manage some secrets manually outside of Hanzo KMS.
• key_schema (String) The format to use for structuring secret keys in the Github destination.