hashicorp / terraform-provider-mysql

Terraform MySQL provider – This Terraform provider is archived per our provider archiving process: https://terraform.io/docs/internals/archiving.html
https://www.terraform.io/docs/providers/mysql/
Mozilla Public License 2.0
61 stars 189 forks source link

Add a mysql_user_password resource for managing passwords with PGP/GPG encryption #47

Closed joestump closed 6 years ago

joestump commented 6 years ago

Attached is a mysql_user_password resource for managing MySQL passwords safely with Terraform. It can be used to assign auto-generated passwords and rotate them. Passwords are stored using PGP encryption in the TF state file.

resource "mysql_user_password" "someone" {
  user    = "${mysql_user.someone.user}"
  pgp_key = "keybase:someuser"
}

You can then output the encrypted_password attribute and decrypt:

terraform output encypted_password | base64 --decode | gpg --decrypt

To rotate the password:

terraform taint mysql_user_password.someone

Here's the main.tf I used for testing:

provider "mysql" {
  endpoint = "localhost:3306"
  username = "root"
}

resource "mysql_user" "jstump" {
  user = "jstump"
}

resource "mysql_user_password" "jstump" {
  user = "${mysql_user.jstump.user}"
  pgp_key = "keybase:joestump"
}

output "encypted_password" {
  value = "${mysql_user_password.jstump.encrypted_password}"
}

Output of make testacc:

$ MYSQL_USERNAME=root MYSQL_ENDPOINT=localhost:3306 MYSQL_PASSWORD='' make testacc
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test $(go list ./... |grep -v 'vendor') -v  -timeout 120m
?       github.com/terraform-providers/terraform-provider-mysql [no test files]
=== RUN   TestProvider
--- PASS: TestProvider (0.00s)
=== RUN   TestProvider_impl
--- PASS: TestProvider_impl (0.00s)
=== RUN   TestAccDatabase
--- PASS: TestAccDatabase (0.04s)
=== RUN   TestAccGrant
--- PASS: TestAccGrant (0.05s)
=== RUN   TestAccUserPassword_basic
--- PASS: TestAccUserPassword_basic (0.94s)
=== RUN   TestAccUser_basic
--- PASS: TestAccUser_basic (0.07s)
=== RUN   TestAccUser_deprecated
--- PASS: TestAccUser_deprecated (0.07s)
PASS
ok      github.com/terraform-providers/terraform-provider-mysql/mysql   1.204s
joestump commented 6 years ago

Once #44 is approved, this should be reviewed and merged into it.