terraform-provider/docs/resources/secret_sync_gitlab.md

page_title, subcategory, description

page_title	subcategory	description
kms_secret_sync_gitlab Resource - terraform-provider	Secret Syncs	Create and manage GitLab secret syncs

kms_secret_sync_gitlab (Resource)

Create and manage GitLab secret syncs

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

# Example 1: Sync secrets to a GitLab project
resource "kms_secret_sync_gitlab" "gitlab-project-sync" {
  name          = "gitlab-project-sync-demo"
  description   = "Demo of GitLab project secret sync"
  project_id    = "<project-id>"
  environment   = "<environment-slug>"
  secret_path   = "/" # Root folder is /
  connection_id = "<gitlab-app-connection-id>"

  sync_options = {
    initial_sync_behavior   = "overwrite-destination", # Supported options: overwrite-destination
    disable_secret_deletion = false,
    key_schema              = "KMS_{{secretKey}}" # Optional, but recommended
  }

  destination_config = {
    scope                  = "project"               # Supported options: project|group
    project_id             = "<gitlab-project-id>"   # Required when scope is "project"
    project_name           = "<gitlab-project-name>" # Optional
    target_environment     = "*"                     # GitLab environment scope
    should_protect_secrets = false
    should_mask_secrets    = true
    should_hide_secrets    = false
  }
}

# Example 2: Sync secrets to a GitLab group
resource "kms_secret_sync_gitlab" "gitlab-group-sync" {
  name          = "gitlab-group-sync-demo"
  description   = "Demo of GitLab group secret sync"
  project_id    = "<project-id>"
  environment   = "<environment-slug>"
  secret_path   = "/"
  connection_id = "<gitlab-app-connection-id>"

  sync_options = {
    initial_sync_behavior   = "overwrite-destination",
    disable_secret_deletion = true,
    key_schema              = "{{secretKey}}"
  }

  destination_config = {
    scope                  = "group"               # Supported options: project|group
    group_id               = "<gitlab-group-id>"   # Required when scope is "group"
    group_name             = "<gitlab-group-name>" # Optional
    target_environment     = "production"          # GitLab environment scope
    should_protect_secrets = true
    should_mask_secrets    = true
    should_hide_secrets    = false
  }
}

Schema

Required

• connection_id (String) The ID of the gitlab Connection to use for syncing.
• destination_config (Attributes) The destination configuration for the secret sync. (see below for nested schema)
• environment (String) The slug of the project environment to sync secrets from.
• name (String) The name of the GitLab sync to create. Must be slug-friendly.
• project_id (String) The ID of the Hanzo KMS project to create the sync in.
• secret_path (String) The folder path to sync secrets from.
• sync_options (Attributes) Parameters to modify how secrets are synced. (see below for nested schema)

Optional

• auto_sync_enabled (Boolean) Whether secrets should be automatically synced when changes occur at the source location or not.
• description (String) An optional description for the GitLab sync.

Read-Only

• id (String) The ID of the GitLab secret sync

Nested Schema for destination_config

Required:

• scope (String) The GitLab scope that secrets should be synced to. Supported options: 'project', 'group'
• target_environment (String) The GitLab environment scope that secrets should be synced to. (default: *)

Optional:

• group_id (String) The GitLab Group ID to sync secrets to. Required when scope is 'group'.
• group_name (String) The GitLab Group Name to sync secrets to. Optional when scope is 'group'.
• project_id (String) The GitLab Project ID to sync secrets to. Required when scope is 'project'.
• project_name (String) The GitLab Project Name to sync secrets to. Optional when scope is 'project'.
• should_hide_secrets (Boolean) Whether variables should be hidden
• should_mask_secrets (Boolean) Whether variables should be masked in logs
• should_protect_secrets (Boolean) Whether variables should be protected

Nested Schema for sync_options

Required:

• initial_sync_behavior (String) Specify how Hanzo KMS should resolve the initial sync to the destination. Supported options: overwrite-destination

Optional:

• disable_secret_deletion (Boolean) When set to true, Hanzo KMS will not remove secrets from GitLab. Enable this option if you intend to manage some secrets manually outside of Hanzo KMS.
• key_schema (String) The format to use for structuring secret keys in the GitLab destination.