Closed joestump closed 6 years ago
Attached is a mysql_user_password resource for managing MySQL passwords safely with Terraform. It can be used to assign auto-generated passwords and rotate them. Passwords are stored using PGP encryption in the TF state file.
mysql_user_password
resource "mysql_user_password" "someone" { user = "${mysql_user.someone.user}" pgp_key = "keybase:someuser" }
You can then output the encrypted_password attribute and decrypt:
encrypted_password
terraform output encypted_password | base64 --decode | gpg --decrypt
To rotate the password:
terraform taint mysql_user_password.someone
Here's the main.tf I used for testing:
main.tf
provider "mysql" { endpoint = "localhost:3306" username = "root" } resource "mysql_user" "jstump" { user = "jstump" } resource "mysql_user_password" "jstump" { user = "${mysql_user.jstump.user}" pgp_key = "keybase:joestump" } output "encypted_password" { value = "${mysql_user_password.jstump.encrypted_password}" }
Output of make testacc:
make testacc
$ MYSQL_USERNAME=root MYSQL_ENDPOINT=localhost:3306 MYSQL_PASSWORD='' make testacc ==> Checking that code complies with gofmt requirements... TF_ACC=1 go test $(go list ./... |grep -v 'vendor') -v -timeout 120m ? github.com/terraform-providers/terraform-provider-mysql [no test files] === RUN TestProvider --- PASS: TestProvider (0.00s) === RUN TestProvider_impl --- PASS: TestProvider_impl (0.00s) === RUN TestAccDatabase --- PASS: TestAccDatabase (0.04s) === RUN TestAccGrant --- PASS: TestAccGrant (0.05s) === RUN TestAccUserPassword_basic --- PASS: TestAccUserPassword_basic (0.94s) === RUN TestAccUser_basic --- PASS: TestAccUser_basic (0.07s) === RUN TestAccUser_deprecated --- PASS: TestAccUser_deprecated (0.07s) PASS ok github.com/terraform-providers/terraform-provider-mysql/mysql 1.204s
Once #44 is approved, this should be reviewed and merged into it.
Attached is a
mysql_user_password
resource for managing MySQL passwords safely with Terraform. It can be used to assign auto-generated passwords and rotate them. Passwords are stored using PGP encryption in the TF state file.You can then output the
encrypted_password
attribute and decrypt:To rotate the password:
Here's the
main.tf
I used for testing:Output of
make testacc
: