Confluent Cloud API key creation using terraform - How to get API secret on Visual code CLI to pass that information to end user?

[syydsohail]

Hi Team,

I have written the terraform script to create Confluent Cloud API key. When I run "terraform apply" command on visual studio code, I am getting only API key details not the secret details.

Is there any way to get the API secret on the visual studio code terminal CLI or route to any external file?

Code.

terraform { required_providers { confluent = { source = "confluentinc/confluent" version = "1.61.0" } } }

provider "confluent" { cloud_api_key = var.confluent_cloud_api_key cloud_api_secret = var.confluent_cloud_api_secret }

resource "confluent_service_account" "svc_func_aws_test" { display_name = "svc_func_aws_test" description = "Service account to consume from 'terraform_test' topic of 'azure-dev-use-env' Kafka cluster" }

resource "confluent_api_key" "svc_func_aws_test-kafka-api-key" { display_name = "svc_func_aws_test-kafka-api-key" description = "Kafka API Key that is owned by 'svc_func_aws_test' service account" owner { id = confluent_service_account.svc_func_aws_test.id api_version = confluent_service_account.svc_func_aws_test.api_version kind = confluent_service_account.svc_func_aws_test.kind }

}

Kind Regards, Sohail

[linouk23]

👋 @syydsohail thanks for creating the issue!

You might want to take a look at

• azure-key-vault
• hashicorp-vault

which is probably the best approach here.

That said, if you want to still just print them, you might find the following article helpful:

• https://support.hashicorp.com/hc/en-us/articles/5175257151891-How-to-output-sensitive-data-with-Terraform

Alternatively you could also try to use

output "cloud_api_key_secret" {
  value = confluent_api_key.svc_func_aws_test-kafka-api-key.secret
}

and then

terraform output cloud_api_key_secret
# or
terraform output -json cloud_api_key_secret
# or
terraform output -raw cloud_api_key_secret

Let us know if that helps!

Note: based on your definition of confluent_api_key.svc_func_aws_test-kafka-api-key, it seems like you might want to rename it to confluent_api_key.svc_func_aws_test-cloud-api-key as you're creating Cloud API Key and not Kafka API Key.

[syydsohail]

Hi @linouk23 ,

Thank you so much, the output option worked for me. I will definitely check the azure-key-vault and hashicorp-vault options.

Thanks again for the help and the Note