Cannot set binary secret using google_secret_manager_secret_version #10129
Comments
|
@devqore error appears to indicate this failure was in the function
|
|
@edwardmedia sure, I followed this suggestion and that created a plain text file with base64 content (output with content already described in the above comment #10129 (comment)). But I think there should be a possibility to save secret as a binary file, as binary files are supported by Google Secret Manager. It would be great to do this using terraform as it's possible to do this using gcloud. |
|
@devqore I think the error is in the |
|
@edwardmedia it creates plain text file encoded as base64 instead of binary file: There should be binary content. I've attached pfx mycert.zip from example, after unzipping try to do: and you will see a lot of I'm aware that may be hard to detect if the secret is given as base64 and should be decoded or not so maybe there should be an additional parameter |
|
@edwardmedia what response is needed here? as I'm seeing added label, without a question. |
|
@devqore sorry I refreshed the page, somehow the new label was added for me. I am not quite sure if I fully understand the issue here. If you run below config, do you see the resource "google_secret_manager_secret_version" "cert-pfx" {
secret = google_secret_manager_secret.cert-pfx.id
secret_data = "issue10129-secret-data"
} |
|
@edwardmedia this is working properly as this is plain text (not binary data). I applied the above {
"mode": "managed",
"type": "google_secret_manager_secret_version",
"name": "cert-pfx",
"provider": "provider[\"registry.terraform.io/hashicorp/google\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"create_time": "2021-09-23T18:26:43.525816Z",
"destroy_time": "",
"enabled": true,
"id": "projects/XXX/secrets/cert-pfx/versions/1",
"name": "projects/XXX/secrets/cert-pfx/versions/1",
"secret": "projects/XXX/secrets/cert-pfx",
"secret_data": "issue10129-secret-data",
"timeouts": null
},
"sensitive_attributes": [],
"private": "XXX",
"dependencies": [
"google_secret_manager_secret.cert-pfx"
]
}
]
},also gcloud returns properly: The problem is how to save binary data like for example pfx/zip or something different, as binary data is supported by Google Secret Manager. For simplicity, you can use this zip file and try to save it like this: resource "google_secret_manager_secret_version" "hello-zip-from-tf" {
secret = google_secret_manager_secret.hello-zip-from-tf.id
secret_data = filebase64("hello.zip")
}and then get secret with: After that create the secret with exactly the same file using Finally, try to download the secret with Is now more clear for you where there is a problem? |
|
@devqore I see. Do you lock down the state in a secure location? If the state does not match what you have in the config, what do you expect every time when you run |
|
@edwardmedia for now I would like to only store binary credentials using tf like I can do this with plain text as this is supported by Google Secret Manager. I'm aware that the state needs to be stored securely. Also, I would expect that |
|
This is probably an enhancement request. It looks like the issue is basically:
The ideal solution might have been to treat secret_data as a base64 string, though that might have made it more annoying for folks trying to use the output value inside their TF configurations? A new field might be a reasonable solution. |
github-actions
bot
added
service/secretmanager
forward/review
|
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. |
Community Note
modular-magicianuser, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned tohashibot, a community member has claimed the issue already.Terraform Version
Affected Resource(s)
Terraform Configuration Files
Currently, there is no possibility to save binary secret in Google Secret Manager using terraform, because
filefunction cannot be used and proposedfilebase64saves file literally content as base64That returns expected failure:
With filebase64 apply is working without issues:
but it contains a plain base64 file (this base64 content is self-generated pfx certificate):
Expected Behavior
There should be a possibility to save a binary file in Google Secret Manager using terraform, maybe with an additional parameter like
secret_data_base64or some kind of detection in thesecret_dataparameter.The text was updated successfully, but these errors were encountered: