2020-05-02 00:27:55 -07:00
# Google Secret Manager Module
Simple Secret Manager module that allows managing one or more secrets, their versions, and IAM bindings.
Secret Manager locations are available via the `gcloud secrets locations list` command.
2020-05-02 00:29:04 -07:00
**Warning:** managing versions will persist their data (the actual secret you want to protect) in the Terraform state in unencrypted form, accessible to any identity able to read or pull the state file.
2020-05-02 00:27:55 -07:00
## Examples
### Secrets
The secret replication policy is automatically managed if no location is set, or manually managed if a list of locations is passed to the secret.
```hcl
module "secret-manager" {
source = "./modules/secret-manager"
project_id = "my-project"
secrets = {
test-auto = null
test-manual = ["europe-west1", "europe-west4"]
}
}
2020-11-07 01:28:33 -08:00
# tftest:modules=1:resources=2
2020-05-02 00:27:55 -07:00
```
### Secret IAM bindings
2020-11-06 00:43:12 -08:00
IAM bindings can be set per secret in the same way as for most other modules supporting IAM, using the `iam` variable.
2020-05-02 00:27:55 -07:00
```hcl
module "secret-manager" {
source = "./modules/secret-manager"
project_id = "my-project"
secrets = {
test-auto = null
test-manual = ["europe-west1", "europe-west4"]
}
2020-11-04 05:19:16 -08:00
iam = {
2020-05-02 00:27:55 -07:00
test-auto = {
"roles/secretmanager.secretAccessor" = ["group:auto-readers@example.com"]
}
test-manual = {
"roles/secretmanager.secretAccessor" = ["group:manual-readers@example.com"]
}
}
}
2020-11-07 01:28:33 -08:00
# tftest:modules=1:resources=4
2020-05-02 00:27:55 -07:00
```
### Secret versions
As mentioned above, please be aware that **version data will be stored in state in unencrypted form** .
```hcl
module "secret-manager" {
source = "./modules/secret-manager"
project_id = "my-project"
secrets = {
test-auto = null
test-manual = ["europe-west1", "europe-west4"]
}
versions = {
2020-05-02 00:34:53 -07:00
test-auto = {
v1 = { enabled = false, data = "auto foo bar baz" }
v2 = { enabled = true, data = "auto foo bar spam" }
},
test-manual = {
v1 = { enabled = true, data = "manual foo bar spam" }
}
2020-05-02 00:27:55 -07:00
}
}
2020-11-07 01:28:33 -08:00
# tftest:modules=1:resources=5
2020-05-02 00:27:55 -07:00
```
<!-- BEGIN TFDOC -->
## Variables
| name | description | type | required | default |
|---|---|:---: |:---:|:---:|
| project_id | Project id where the keyring will be created. | < code title = "" > string< / code > | ✓ | |
2020-11-04 05:19:16 -08:00
| *iam* | IAM bindings in {SECRET => {ROLE => [MEMBERS]}} format. | < code title = "map(map(list(string)))" > map(map(list(string)))</ code > | | < code title = "" > {}</ code > |
2020-05-02 00:27:55 -07:00
| *labels* | Optional labels for each secret. | < code title = "map(map(string))" > map(map(string))</ code > | | < code title = "" > {}</ code > |
| *secrets* | Map of secrets to manage and their locations. If locations is null, automatic management will be set. | < code title = "map(list(string))" > map(list(string))</ code > | | < code title = "" > {}</ code > |
2020-07-01 23:29:38 -07:00
| *versions* | Optional versions to manage for each secret. Version names are only used internally to track individual versions. | < code title = "map(map(object({ enabled = bool data = string })))" > map(map(object({...})))</ code > | | < code title = "" > {}</ code > |
2020-05-02 00:27:55 -07:00
## Outputs
| name | description | sensitive |
|---|---|:---:|
| ids | Secret ids keyed by secret_ids (names). | |
| secrets | Secret resources. | |
| version_ids | Version ids keyed by secret name : version name. | |
| versions | Secret versions. | |
<!-- END TFDOC -->
## Requirements
These sections describe requirements for using this module.
### IAM
The following roles must be used to provision the resources of this module:
- Cloud KMS Admin: `roles/cloudkms.admin` or
- Owner: `roles/owner`
### APIs
A project with the following APIs enabled must be used to host the
resources of this module:
- Google Cloud Key Management Service: `cloudkms.googleapis.com`
