search

secrethub / terraform-provider-secrethub

Terraform Provider to manage and use secrets
https://secrethub.io
Apache License 2.0
49 stars 11 forks source link

Allow setting credential_passphrase without setting credential #125

Closed SimonBarendse closed 3 years ago

SimonBarendse commented 3 years ago

An example usecase would be when running Terraform locally. You can have your personal credential in ~/.secrethub/credential auto-detected and use a tfvar to pass the credential passphrase. Then Terraform would prompt for your passphrase on running terraform commands:

variable "secrethub_credential_passphrase" {
  type = string
  description = "Passphrase for the auto-detected SecretHub credential (leave empty if your credential is not passphrase protected)"
}

provider "secrethub" {
  credential_passphrase = var.secrethub_credential_passphrase
}

Additionally, this PR improves the error message on missing credential passphrases.

Previously, it showed:

passphrase is incorrect (credentials.cannot_decrypt_credential)

now it will show:

credential is password-protected. Configure a credential passphrase through the SECRETHUB_CREDENTIAL_PASSPHRASE environment variable or use a credential that is not password-protected (credentials.credential_passphrase_required)