Support for decrypt secrets from data encrypted with Azure keyvault key

hashicorp / terraform-provider-azurerm

Terraform provider for Azure Resource Manager

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs

Mozilla Public License 2.0

4.6k stars 4.65k forks source link

Support for decrypt secrets from data encrypted with Azure keyvault key #7856

Open saranshlamba opened 4 years ago

saranshlamba commented 4 years ago

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

AWS provider has this data source which decrypts cipherblob and then stores it in plain text within secrets manager. Need similar functionality for azurerm, which will decrypt the cipherblob (using keyvault key) and then store it in plain text in keyvault secrets.

https://www.terraform.io/docs/providers/aws/d/kms_secrets.html

tombuildsstuff commented 4 years ago

hey @saranshlamba

Thanks for opening this issue.

So that we can better understand the use-case/requirements here, would you be able to give a little more context on the use-case your looking to solve with this functionality?

Thanks!

saranshlamba commented 4 years ago

@tombuildsstuff With this functionality it will be easier to store encrypted secrets in github as a source of truth. Right now there isn't an easy way to store and track secrets in git.

saranshlamba commented 3 years ago

@tombuildsstuff Any updates on it, please?

IanMoroney commented 3 years ago

@saranshlamba, correct me if I'm wrong, but just so I understand this use case:

Encrypt a static secret either manually, or using azurerm_key_vault_key_encrypt
Decrypt a secret using a azurerm_key_vault_key_decrypt data block, for use in other resources.

This encrypts the contents of secrets in key vault so if you go to show secret value in the key vault, it shows you an encrypted string instead of the plain text.