search

Infisical / terraform-provider-infisical

The offical Infisical Terraform provider
Mozilla Public License 2.0
7 stars 5 forks source link

Secret UPDATE not working #31

Open istarkov opened 5 months ago

istarkov commented 5 months ago

Execute following terraform code 

terraform apply --var INFISCAL_TOKEN=$(infisical service-token create --scope='dev:/SETUPTOOLS/**' --access-level=read --access-level=write -e 100 --token-only)

Following configuaration

provider "infisical" {
  alias         = "infiscal"
  host          = "https://app.infisical.com" # Only required if using self hosted instance of Infisical, default is https://app.infisical.com
  service_token = var.INFISCAL_TOKEN
}

terraform {
  required_providers {
    infisical = {
      # version = <latest version>
      source = "infisical/infisical"
    }

    htpasswd = {
      source = "loafoe/htpasswd"
    }
}

resource "random_password" "password" {
  length = 30
}

resource "random_password" "salt" {
  length = 8
}

resource "htpasswd_password" "hash" {
  password = random_password.password.result
  salt     = random_password.salt.result
}

resource "infisical_secret" "twine_username" {
  provider    = infisical.infiscal
  name        = "TWINE_USERNAME"
  value       = "opti-pypi"
  env_slug    = "dev"
  folder_path = "/SETUPTOOLS/PYPI-SERVER"
}

resource "infisical_secret" "twine_password" {
  provider = infisical.infiscal

  name = "TWINE_PASSWORD"

  value       = random_password.password.result
  env_slug    = "dev"
  folder_path = "/SETUPTOOLS/PYPI-SERVER"
}

resource "infisical_secret" "twine_htpasswd" {
  provider = infisical.infiscal

  name  = ".htpasswd"
  value = "${infisical_secret.twine_username.value}:${htpasswd_password.hash.apr1}"

  env_slug    = "dev"
  folder_path = "/SETUPTOOLS/PYPI-SERVER"
}

It works on 1st run without issues. Now change value = "opti-pypi" to something like value = "opti"

Reapply with same command, and Im getting following errors:

infisical_secret.twine_username: Modifying... [name=TWINE_USERNAME]
╷
│ Error: Error updating secret
│ 
│   with infisical_secret.twine_username,
│   on 30-infisical-pwd.tf line 15, in resource "infisical_secret" "twine_username":
│   15: resource "infisical_secret" "twine_username" {
│ 
│ Couldn't save encrypted secrets to Infiscial, unexpected error: CallUpdateSecretsV3: Unsuccessful response. Please make sure your secret path, workspace and
│ environment name are all correct [response={"type":"bad_request","message":"Missing encrypted
│ key","context":{},"level":30,"level_name":"INFO","status_code":400,"datetime_iso":"2024-01-21T14:45:54.890Z","application":"unknown","extra":[]}]
╵
failed to wait for command termination: exit status 1
keinsell commented 5 months ago

Managed to solve issue, still not sure what was exact cause and if secrets are updating or not but in my case it was lack of wildcard access to directories at service access token. ~ https://github.com/Infisical/terraform-provider-infisical/issues/33#issuecomment-1913262296

mkosmo commented 2 months ago

I'm also running into this and I can't figure out why. I have to drop them, delete them from state, and try again. The service token in use has RW access to /**

maidul98 commented 2 months ago

@DanielHougaard can you please talk a look when you have time?

mkosmo commented 2 months ago

If it helps, here are some of the relevant logs from my attempts to change an existing secret. What catches my eye is the response: [response={"statusCode":400,"message":"Secret already exist","error":"BadRequest"}]

Excerpts were just executed now, keys have since been rotated again in case I missed a redaction.

Plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # infisical_secret.aws_access_key_id_dev will be updated in-place
  ~ resource "infisical_secret" "aws_access_key_id_dev" {
      ~ last_updated = "Friday, 05-Apr-24 22:21:34 CDT" -> (known after apply)
        name         = "AWS_ACCESS_KEY_ID"
      ~ value        = "REDACTED" -> "REDACTED"
        # (3 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.
2024-04-09T11:22:45.246-0500 [INFO]  backend/local: apply calling Apply

Apply

infisical_secret.aws_access_key_id_dev: Modifying... [name=AWS_ACCESS_KEY_ID]
2024-04-09T11:22:46.369-0500 [INFO]  Starting apply for infisical_secret.aws_access_key_id_dev
2024-04-09T11:22:46.369-0500 [DEBUG] infisical_secret.aws_access_key_id_dev: applying the planned Update change
2024-04-09T11:22:46.370-0500 [DEBUG] provider.terraform-provider-infisical_v0.4.0: Calling provider defined Resource Configure: @module=sdk.framework tf_req_id=b18c88af-b139-c23a-0200-d5f93f089cc8 tf_rpc=ApplyResourceChange @caller=github.com/hashicorp/terraform-plugin-framework@v1.3.0/internal/fwserver/server_updateresource.go:55 tf_provider_addr=registry.terraform.io/infisical/infisical tf_resource_type=infisical_secret timestamp=2024-04-09T11:22:46.370-0500
2024-04-09T11:22:46.370-0500 [DEBUG] provider.terraform-provider-infisical_v0.4.0: Called provider defined Resource Configure: tf_provider_addr=registry.terraform.io/infisical/infisical tf_req_id=b18c88af-b139-c23a-0200-d5f93f089cc8 tf_resource_type=infisical_secret tf_rpc=ApplyResourceChange @caller=github.com/hashicorp/terraform-plugin-framework@v1.3.0/internal/fwserver/server_updateresource.go:57 @module=sdk.framework timestamp=2024-04-09T11:22:46.370-0500
2024-04-09T11:22:46.370-0500 [DEBUG] provider.terraform-provider-infisical_v0.4.0: Calling provider defined Resource Update: @caller=github.com/hashicorp/terraform-plugin-framework@v1.3.0/internal/fwserver/server_updateresource.go:121 @module=sdk.framework tf_provider_addr=registry.terraform.io/infisical/infisical tf_resource_type=infisical_secret tf_rpc=ApplyResourceChange tf_req_id=b18c88af-b139-c23a-0200-d5f93f089cc8 timestamp=2024-04-09T11:22:46.370-0500
2024-04-09T11:22:47.502-0500 [DEBUG] provider.terraform-provider-infisical_v0.4.0: Called provider defined Resource Update: tf_req_id=b18c88af-b139-c23a-0200-d5f93f089cc8 tf_rpc=ApplyResourceChange tf_provider_addr=registry.terraform.io/infisical/infisical tf_resource_type=infisical_secret @caller=github.com/hashicorp/terraform-plugin-framework@v1.3.0/internal/fwserver/server_updateresource.go:123 @module=sdk.framework timestamp=2024-04-09T11:22:47.502-0500
2024-04-09T11:22:47.502-0500 [ERROR] provider.terraform-provider-infisical_v0.4.0: Response contains error diagnostic: diagnostic_summary="Error updating secret" tf_resource_type=infisical_secret tf_proto_version=6.3 diagnostic_detail="Couldn't save encrypted secrets to Infiscial, unexpected error: CallUpdateSecretsV3: Unsuccessful response. Please make sure your secret path, workspace and environment name are all correct [response={"statusCode":400,"message":"Secret already exist","error":"BadRequest"}]" tf_rpc=ApplyResourceChange @caller=github.com/hashicorp/terraform-plugin-go@v0.15.0/tfprotov6/internal/diag/diagnostics.go:55 @module=sdk.proto diagnostic_severity=ERROR tf_provider_addr=registry.terraform.io/infisical/infisical tf_req_id=b18c88af-b139-c23a-0200-d5f93f089cc8 timestamp=2024-04-09T11:22:47.502-0500
2024-04-09T11:22:47.533-0500 [DEBUG] State storage *statemgr.Filesystem declined to persist a state snapshot
2024-04-09T11:22:47.533-0500 [ERROR] vertex "infisical_secret.aws_access_key_id_dev" error: Error updating secret
╷
│ Warning: Resource targeting is in effect
│ 
│ You are creating a plan with the -target option, which means that the
│ result of this plan may not represent all of the changes requested by the
│ current configuration.
│ 
│ The -target option is not for routine use, and is provided only for
│ exceptional situations such as recovering from errors or mistakes, or when
│ Terraform specifically suggests to use it as part of an error message.
╵
╷
│ Warning: Applied changes may be incomplete
│ 
│ The plan was created with the -target option in effect, so some changes
│ requested in the configuration may have been ignored and the output values
│ may not be fully updated. Run the following command to verify that no other
│ changes are pending:
│     terraform plan
│  
│ Note that the -target option is not suitable for routine use, and is
│ provided only for exceptional situations such as recovering from errors or
│ mistakes, or when Terraform specifically suggests to use it as part of an
│ error message.
╵
╷
│ Error: Error updating secret
│ 
│   with infisical_secret.aws_access_key_id_dev,
│   on aws_iam_terraform.tf line 14, in resource "infisical_secret" "aws_access_key_id_dev":
│   14: resource "infisical_secret" "aws_access_key_id_dev" {
│ 
│ Couldn't save encrypted secrets to Infiscial, unexpected error:
│ CallUpdateSecretsV3: Unsuccessful response. Please make sure your secret
│ path, workspace and environment name are all correct
│ [response={"statusCode":400,"message":"Secret already
│ exist","error":"BadRequest"}]
╵