search

hashicorp / terraform-provider-tls

Utility provider that works with Transport Layer Security keys and certificates. It provides resources that allow private keys, certificates and certficate requests to be created as part of a Terraform deployment.
https://registry.terraform.io/providers/hashicorp/tls/latest
Mozilla Public License 2.0
182 stars 103 forks source link

rsa_bits is set for tls_private_key even when algorithm = "ECDSA" #295

Open tspearconquest opened 1 year ago

tspearconquest commented 1 year ago

Terraform CLI and Provider Versions

Terraform v1.3.1
on darwin_amd64
+ provider registry.terraform.io/hashicorp/tls v4.0.4

Your version of Terraform is out of date! The latest version
is 1.3.6. You can update by downloading from https://www.terraform.io/downloads.html

Terraform Configuration

resource "tls_private_key" "server_key" {
  algorithm   = "ECDSA"
  ecdsa_curve = "P521"
}

Expected Behavior

  # tls_private_key.server_key will be created
  + resource "tls_private_key" "server_key" {
      + algorithm                     = "ECDSA"
      + ecdsa_curve                   = "P521"
      + id                            = (known after apply)
      + private_key_openssh           = (sensitive value)
      + private_key_pem               = (sensitive value)
      + private_key_pem_pkcs8         = (sensitive value)
      + public_key_fingerprint_md5    = (known after apply)
      + public_key_fingerprint_sha256 = (known after apply)
      + public_key_openssh            = (known after apply)
      + public_key_pem                = (known after apply)
    }

Actual Behavior

  # tls_private_key.server_key will be created
  + resource "tls_private_key" "server_key" {
      + algorithm                     = "ECDSA"
      + ecdsa_curve                   = "P521"
      + id                            = (known after apply)
      + private_key_openssh           = (sensitive value)
      + private_key_pem               = (sensitive value)
      + private_key_pem_pkcs8         = (sensitive value)
      + public_key_fingerprint_md5    = (known after apply)
      + public_key_fingerprint_sha256 = (known after apply)
      + public_key_openssh            = (known after apply)
      + public_key_pem                = (known after apply)
      + rsa_bits                      = 2048
    }

Steps to Reproduce

  1. terraform plan

How much impact is this issue causing?

Low

Logs

No response

Additional Information

The documentation mentions that this value is only used when algorithm = "RSA" so there is no reason for it to be included in the state file or outputs. When algorithm = "ECDSA" or algorithm = "ED25519", Terraform should hide the rsa_bits line and not save the value to the state file.

I want to use tls_private_key to generate a private ECDSA key for signing my own CA with tls_self_signed_cert, but I don't want any RSA related information in the state file or output, since I'm not requesting an RSA key.

This seems to only affect the output and the values saved into the state file, but does not appear to cause any abnormal functionality in the provider or the generated certificates in the state.

Code of Conduct

tspearconquest commented 1 year ago

Actually, upon further testing, this does cause abnormal functionality.

I left out the rsa_bits with algorithm = "ECDSA" and generated a certificate locally with terraform plan followed by terraform apply.

Then I ran terraform plan again to confirm no changes:

❯ terraform plan -out plan
tls_private_key.ca_key: Refreshing state... [id=096300c25a9a634a5b6b3b6039ca9b2b77e7baa6]
tls_private_key.server_key: Refreshing state... [id=801a05e31a79fb9051625dfe5d4ebd65ee049508]
tls_cert_request.server_csr: Refreshing state... [id=d8e49e436e0ade51e593822b26b36fd7edd818a2]
tls_self_signed_cert.ca_cert: Refreshing state... [id=263861910634595957572633798312256012026]
tls_locally_signed_cert.server_cert: Refreshing state... [id=211343064850266243715313131738143119829]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration and found no differences, so no changes are needed.

Then I added the line rsa_bits = 0 to my resource, as below:

resource "tls_private_key" "server_key" {
  algorithm   = "ECDSA"
  ecdsa_curve = "P521"
  rsa_bits    = 0
}

Then ran terraform plan again: image