Skip to content

Add support for is_secret_data_base64 in secret_version and secret_version_access datasources for global and regional stacks #8394

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 11, 2024
Merged

Add support for is_secret_data_base64 in secret_version and secret_version_access datasources for global and regional stacks #8394

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .changelog/11877.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
```release-note:enhancement
secretmanager: added `is_secret_data_base64` field to `google_secret_manager_secret_version` and `google_secret_manager_secret_version_access` datasources
```
```release-note:enhancement
secretmanagerregional: added `is_secret_data_base64` field to `google_secret_manager_regional_secret_version` and `google_secret_manager_regional_secret_version_access` datasources
```
19 changes: 15 additions & 4 deletions google-beta/services/secretmanager/data_source_secret_manager_secret_version.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,11 @@ func DataSourceSecretManagerSecretVersion() *schema.Resource {
Computed: true,
Sensitive: true,
},
"is_secret_data_base64": {
Type: schema.TypeBool,
Optional: true,
Default: false,
},
},
}
}
Expand Down Expand Up @@ -149,11 +154,17 @@ func dataSourceSecretManagerSecretVersionRead(d *schema.ResourceData, meta inter
}

data := resp["payload"].(map[string]interface{})
secretData, err := base64.StdEncoding.DecodeString(data["data"].(string))
if err != nil {
return fmt.Errorf("Error decoding secret manager secret version data: %s", err.Error())
var secretData string
if d.Get("is_secret_data_base64").(bool) {
secretData = data["data"].(string)
} else {
payloadData, err := base64.StdEncoding.DecodeString(data["data"].(string))
if err != nil {
return fmt.Errorf("error decoding secret manager secret version data: %s", err.Error())
}
secretData = string(payloadData)
}
if err := d.Set("secret_data", string(secretData)); err != nil {
if err := d.Set("secret_data", secretData); err != nil {
return fmt.Errorf("Error setting secret_data: %s", err)
}

Expand Down
19 changes: 15 additions & 4 deletions google-beta/services/secretmanager/data_source_secret_manager_secret_version_access.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,11 @@ func DataSourceSecretManagerSecretVersionAccess() *schema.Resource {
Computed: true,
Sensitive: true,
},
"is_secret_data_base64": {
Type: schema.TypeBool,
Optional: true,
Default: false,
},
},
}
}
Expand Down Expand Up @@ -114,11 +119,17 @@ func dataSourceSecretManagerSecretVersionAccessRead(d *schema.ResourceData, meta
}

data := resp["payload"].(map[string]interface{})
secretData, err := base64.StdEncoding.DecodeString(data["data"].(string))
if err != nil {
return fmt.Errorf("Error decoding secret manager secret version data: %s", err.Error())
var secretData string
if d.Get("is_secret_data_base64").(bool) {
secretData = data["data"].(string)
} else {
payloadData, err := base64.StdEncoding.DecodeString(data["data"].(string))
if err != nil {
return fmt.Errorf("error decoding secret manager secret version data: %s", err.Error())
}
secretData = string(payloadData)
}
if err := d.Set("secret_data", string(secretData)); err != nil {
if err := d.Set("secret_data", secretData); err != nil {
return fmt.Errorf("Error setting secret_data: %s", err)
}

Expand Down
70 changes: 47 additions & 23 deletions google-beta/services/secretmanager/data_source_secret_manager_secret_version_access_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,12 @@
package secretmanager_test

import (
"errors"
"fmt"
"testing"

"github.com/hashicorp/terraform-provider-google-beta/google-beta/acctest"

"github.com/hashicorp/terraform-plugin-testing/helper/resource"
"github.com/hashicorp/terraform-plugin-testing/terraform"
)

func TestAccDatasourceSecretManagerSecretVersionAccess_basic(t *testing.T) {
Expand All @@ -26,7 +24,8 @@ func TestAccDatasourceSecretManagerSecretVersionAccess_basic(t *testing.T) {
{
Config: testAccDatasourceSecretManagerSecretVersionAccess_basic(randomString),
Check: resource.ComposeTestCheckFunc(
testAccCheckDatasourceSecretManagerSecretVersionAccess("data.google_secret_manager_secret_version_access.basic", "1"),
testAccCheckDatasourceSecretManagerSecretVersion("data.google_secret_manager_secret_version_access.basic", "1"),
testAccCheckSecretManagerSecretVersionSecretDataDatasourceMatchesResource("data.google_secret_manager_secret_version_access.basic", "google_secret_manager_secret_version.secret-version-basic"),
),
},
},
Expand All @@ -46,34 +45,34 @@ func TestAccDatasourceSecretManagerSecretVersionAccess_latest(t *testing.T) {
{
Config: testAccDatasourceSecretManagerSecretVersionAccess_latest(randomString),
Check: resource.ComposeTestCheckFunc(
testAccCheckDatasourceSecretManagerSecretVersionAccess("data.google_secret_manager_secret_version_access.latest", "2"),
testAccCheckDatasourceSecretManagerSecretVersion("data.google_secret_manager_secret_version_access.latest", "2"),
testAccCheckSecretManagerSecretVersionSecretDataDatasourceMatchesResource("data.google_secret_manager_secret_version_access.latest", "google_secret_manager_secret_version.secret-version-basic-2"),
),
},
},
})
}

func testAccCheckDatasourceSecretManagerSecretVersionAccess(n, expected string) resource.TestCheckFunc {
return func(s *terraform.State) error {
rs, ok := s.RootModule().Resources[n]
if !ok {
return fmt.Errorf("Can't find Secret Version data source: %s", n)
}

if rs.Primary.ID == "" {
return errors.New("data source ID not set.")
}
func TestAccDatasourceSecretManagerSecretVersionAccess_withBase64SecretData(t *testing.T) {
t.Parallel()

version, ok := rs.Primary.Attributes["version"]
if !ok {
return errors.New("can't find 'version' attribute")
}
randomString := acctest.RandString(t, 10)
data := "./test-fixtures/binary-file.pfx"

if version != expected {
return fmt.Errorf("expected %s, got %s, version not found", expected, version)
}
return nil
}
acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
CheckDestroy: testAccCheckSecretManagerSecretVersionDestroyProducer(t),
Steps: []resource.TestStep{
{
Config: testAccDatasourceSecretManagerSecretVersionAccess_withBase64SecretData(randomString, data),
Check: resource.ComposeTestCheckFunc(
testAccCheckDatasourceSecretManagerSecretVersion("data.google_secret_manager_secret_version_access.basic-base64", "1"),
testAccCheckSecretManagerSecretVersionSecretDataDatasourceMatchesResource("data.google_secret_manager_secret_version_access.basic-base64", "google_secret_manager_secret_version.secret-version-basic-base64"),
),
},
},
})
}

func testAccDatasourceSecretManagerSecretVersionAccess_latest(randomString string) string {
Expand Down Expand Up @@ -129,3 +128,28 @@ data "google_secret_manager_secret_version_access" "basic" {
}
`, randomString, randomString)
}

func testAccDatasourceSecretManagerSecretVersionAccess_withBase64SecretData(randomString, data string) string {
return fmt.Sprintf(`
resource "google_secret_manager_secret" "secret-basic-base64" {
secret_id = "tf-test-secret-version-%s"
labels = {
label = "my-label"
}
replication {
auto {}
}
}

resource "google_secret_manager_secret_version" "secret-version-basic-base64" {
secret = google_secret_manager_secret.secret-basic-base64.name
is_secret_data_base64 = true
secret_data = filebase64("%s")
}

data "google_secret_manager_secret_version_access" "basic-base64" {
secret = google_secret_manager_secret_version.secret-version-basic-base64.secret
is_secret_data_base64 = true
}
`, randomString, data)
}
86 changes: 86 additions & 0 deletions google-beta/services/secretmanager/data_source_secret_manager_secret_version_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ func TestAccDatasourceSecretManagerSecretVersion_basic(t *testing.T) {
Config: testAccDatasourceSecretManagerSecretVersion_basic(randomString),
Check: resource.ComposeTestCheckFunc(
testAccCheckDatasourceSecretManagerSecretVersion("data.google_secret_manager_secret_version.basic", "1"),
testAccCheckSecretManagerSecretVersionSecretDataDatasourceMatchesResource("data.google_secret_manager_secret_version.basic", "google_secret_manager_secret_version.secret-version-basic"),
),
},
},
Expand All @@ -47,6 +48,29 @@ func TestAccDatasourceSecretManagerSecretVersion_latest(t *testing.T) {
Config: testAccDatasourceSecretManagerSecretVersion_latest(randomString),
Check: resource.ComposeTestCheckFunc(
testAccCheckDatasourceSecretManagerSecretVersion("data.google_secret_manager_secret_version.latest", "2"),
testAccCheckSecretManagerSecretVersionSecretDataDatasourceMatchesResource("data.google_secret_manager_secret_version.latest", "google_secret_manager_secret_version.secret-version-basic-2"),
),
},
},
})
}

func TestAccDatasourceSecretManagerSecretVersion_withBase64SecretData(t *testing.T) {
t.Parallel()

randomString := acctest.RandString(t, 10)
data := "./test-fixtures/binary-file.pfx"

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
CheckDestroy: testAccCheckSecretManagerSecretVersionDestroyProducer(t),
Steps: []resource.TestStep{
{
Config: testAccDatasourceSecretManagerSecretVersion_withBase64SecretData(randomString, data),
Check: resource.ComposeTestCheckFunc(
testAccCheckDatasourceSecretManagerSecretVersion("data.google_secret_manager_secret_version.basic-base64", "1"),
testAccCheckSecretManagerSecretVersionSecretDataDatasourceMatchesResource("data.google_secret_manager_secret_version.basic-base64", "google_secret_manager_secret_version.secret-version-basic-base64"),
),
},
},
Expand Down Expand Up @@ -76,6 +100,43 @@ func testAccCheckDatasourceSecretManagerSecretVersion(n, expected string) resour
}
}

func testAccCheckSecretManagerSecretVersionSecretDataDatasourceMatchesResource(datasource, resource string) resource.TestCheckFunc {
return func(s *terraform.State) error {
rs, ok := s.RootModule().Resources[resource]
if !ok {
return fmt.Errorf("can't find Secret Version resource: %s", resource)
}

ds, ok := s.RootModule().Resources[datasource]
if !ok {
return fmt.Errorf("can't find Secret Version data source: %s", datasource)
}

if rs.Primary.ID == "" {
return errors.New("resource ID not set.")
}

if ds.Primary.ID == "" {
return errors.New("data source ID not set.")
}

resourceSecretData, ok := rs.Primary.Attributes["secret_data"]
if !ok {
return errors.New("can't find 'secret_data' attribute in Secret Version resource")
}

datasourceSecretData, ok := ds.Primary.Attributes["secret_data"]
if !ok {
return errors.New("can't find 'secret_data' attribute in Secret Version data source")
}

if resourceSecretData != datasourceSecretData {
return fmt.Errorf("expected %s, got %s, secret_data doesn't match", resourceSecretData, datasourceSecretData)
}
return nil
}
}

func testAccDatasourceSecretManagerSecretVersion_latest(randomString string) string {
return fmt.Sprintf(`
resource "google_secret_manager_secret" "secret-basic" {
Expand Down Expand Up @@ -129,3 +190,28 @@ data "google_secret_manager_secret_version" "basic" {
}
`, randomString, randomString)
}

func testAccDatasourceSecretManagerSecretVersion_withBase64SecretData(randomString, data string) string {
return fmt.Sprintf(`
resource "google_secret_manager_secret" "secret-basic-base64" {
secret_id = "tf-test-secret-version-%s"
labels = {
label = "my-label"
}
replication {
auto {}
}
}

resource "google_secret_manager_secret_version" "secret-version-basic-base64" {
secret = google_secret_manager_secret.secret-basic-base64.name
is_secret_data_base64 = true
secret_data = filebase64("%s")
}

data "google_secret_manager_secret_version" "basic-base64" {
secret = google_secret_manager_secret_version.secret-version-basic-base64.secret
is_secret_data_base64 = true
}
`, randomString, data)
}
20 changes: 15 additions & 5 deletions ...beta/services/secretmanagerregional/data_source_secret_manager_regional_secret_version.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,11 @@ func DataSourceSecretManagerRegionalRegionalSecretVersion() *schema.Resource {
},
},
},
"is_secret_data_base64": {
Type: schema.TypeBool,
Optional: true,
Default: false,
},
},
}
}
Expand Down Expand Up @@ -195,12 +200,17 @@ func dataSourceSecretManagerRegionalRegionalSecretVersionRead(d *schema.Resource
}

data := resp["payload"].(map[string]interface{})
secretData, err := base64.StdEncoding.DecodeString(data["data"].(string))
if err != nil {
return fmt.Errorf("Error decoding secret manager regional secret version data: %s", err.Error())
var secretData string
if d.Get("is_secret_data_base64").(bool) {
secretData = data["data"].(string)
} else {
payloadData, err := base64.StdEncoding.DecodeString(data["data"].(string))
if err != nil {
return fmt.Errorf("error decoding secret manager regional secret version data: %s", err.Error())
}
secretData = string(payloadData)
}

if err := d.Set("secret_data", string(secretData)); err != nil {
if err := d.Set("secret_data", secretData); err != nil {
return fmt.Errorf("Error setting secret_data: %s", err)
}

Expand Down
19 changes: 15 additions & 4 deletions ...rvices/secretmanagerregional/data_source_secret_manager_regional_secret_version_access.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,11 @@ func DataSourceSecretManagerRegionalRegionalSecretVersionAccess() *schema.Resour
Computed: true,
Sensitive: true,
},
"is_secret_data_base64": {
Type: schema.TypeBool,
Optional: true,
Default: false,
},
},
}
}
Expand Down Expand Up @@ -150,11 +155,17 @@ func dataSourceSecretManagerRegionalRegionalSecretVersionAccessRead(d *schema.Re
}

data := resp["payload"].(map[string]interface{})
secretData, err := base64.StdEncoding.DecodeString(data["data"].(string))
if err != nil {
return fmt.Errorf("error decoding secret manager regional secret version data: %s", err.Error())
var secretData string
if d.Get("is_secret_data_base64").(bool) {
secretData = data["data"].(string)
} else {
payloadData, err := base64.StdEncoding.DecodeString(data["data"].(string))
if err != nil {
return fmt.Errorf("error decoding secret manager regional secret version data: %s", err.Error())
}
secretData = string(payloadData)
}
if err := d.Set("secret_data", string(secretData)); err != nil {
if err := d.Set("secret_data", secretData); err != nil {
return fmt.Errorf("error setting secret_data: %s", err)
}

Expand Down
Loading