search

hashicorp / terraform-provider-vault

Terraform Vault provider
https://www.terraform.io/docs/providers/vault/
Mozilla Public License 2.0
458 stars 540 forks source link

[Enhancement]: Allow updating `vault_kv_secret_v2 metadata` with `disable_read=true` #2273

Open mxk opened 3 months ago

mxk commented 3 months ago

Description

We are using Terraform to provision our Vault, but we cannot have any secrets show up in the state. We would like to use vault_kv_secret_v2 to create keys and optionally set non-secret metadata. With disable_read=true, we understand that drift would not be detected, but the desired behavior is that any updates to the metadata in Terraform config would be applied.

Currently, this does not work because with data_json set to "{}", any metadata changes wipe all the actual data that was set via the Vault CLI.

Affected Resource(s) and/or Data Source(s)

Potential Terraform Configuration

resource "vault_kv_secret_v2" "main" {
  mount               = vault_mount.main.path
  name                = "key"
  disable_read        = true
  delete_all_versions = true
  data_json           = "{}" # Would rather set to null

  custom_metadata {
    data = { key = "value" }
  }
}

References

No response

Would you like to implement a fix?

No