Decouple Azure Key Vault Secret resource metadata from its value

[stefangrosaru]

Is there an existing issue for this?

• [X] I have searched the existing issues

Community Note

• Please vote on this issue by adding a :thumbsup: reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Description

Currently when using the azurerm provider to create an Azure Key Vault Secret, the secret value is stored in the raw state as plain-text.

This is well documented in the provider documentation, but the problem is that it makes secret resource creation less ideal via terraform.

Ideally the secret resource creation and the secret value should be decoupled, so that secrets can be created by terraform, without storing their value in state, and then the value can be managed through other means.

This allows existing workflows to continue working as they did until now, but it would enable a better way to create and manage secrets.

For reference, this is similar to the way that the AWS provider currently works. This provider is really popular and it's safe to assume that folks using both providers, or transitioning from one to the other would expect secret management to work in a similar capacity.

New or Affected Resource(s)/Data Source(s)

azurerm_key_vault_secret

Potential Terraform Configuration

No response

References

No response

[jrddunbr]

Sorry if I should make a separate issue but it seems related enough -

To provide a concrete use case to this, my employer stores encrypted resources related to PCI cardholder information in an Azure Key Vault.

We refuse to allow Terraform (or our automation around it) to be able to read these encryption keys, and would like an option to allow it to not try to read the value into Terraform state or even make the API call that requests the secret values. But, there is still value in the key vault's properties being able to be referenced in the Terraform code.