search

scottwinkler / terraform-provider-shell

Terraform provider for executing shell commands and saving output to state file
Mozilla Public License 2.0
279 stars 60 forks source link

Question: How to force current value (not from state) for DELETE command? #102

Open dsch opened 2 years ago

dsch commented 2 years ago

How can I use the current value in sensitive_environment for the DELETE command? As far as I understand the environment is stored in the state and the same environment used for CREATE is also used for DELETE. This makes probably sense for most use cases.

My use-case: I'm using a shell_script resource to create a API token for an REST API. I need first to authenticate with username/password to create the token. The password is passed as sensitive_environment to the command. The password is stored in a terraform_remote_state.

If the password gets rotated in the remote state the token can't be deleted anymore since the 'old' password is still used. Because it's stored in the state and used for the delete command.

benohara commented 2 years ago

Seeing the same problem.

Use a data source to get the token, pass the token into a shell resource which creates fine....but the delete sends the old token from the state and fails.

benohara commented 2 years ago

Actually, seems to work if....generate the token via the data resource...output that from the module and set it on the sensitive_environment of the provider config...pass the provider into the module and dont pass the token into the resources, let them use the variable from the provider.