Set the latest google_secret_manager_secret_version to a specific value

[philip-harvey]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

1.4.4
provider registry.terraform.io/hashicorp/google v4.63.1

Affected Resource(s)

google_secret_manager_secret_version

Terraform Configuration Files

resource "google_secret_manager_secret_version" "version" {
secret = google_secret_manager_secret.secret.id
secret_data = "secret data here"
}

Expected Behavior

After running an apply the value of the latest version of the secret should contain the contents of secret_data

Actual Behavior

Latest version does not contain the contents of secret_data

Steps to Reproduce

1. terraform apply
2. add a new version to the secret outside of terraform. e.g. via the console. Do not destroy the old version.
3. terraform apply

The apply on line 3 will show no changes, but it should have created a new version with the value of secret_data

Important Factoids

google_secret_manager_secret_version doesn't have any input value for version or a flag to ensure that the configured version is the latest.

[edwardmedia]

@philip-harvey I think this is by design as secret_data is marked as sensitive

[philip-harvey]

@philip-harvey I think this is by design as secret_data is marked as sensitive

Hi @edwardmedia. I'm not following, Terraform know what's in the secret_data, but doesn't actually put this into the GCP secret version.

[edwardmedia]

@philip-harvey I see what you meant. After you finished step 2, the terraform has no knowledge of it. It stays with the old version. Apply doesn't work as it keeps pulling the existing version. You need to import by providing the specific version. As you may see version is a readonly attribute which helps terraform to main the state.

terraform import google_secret_manager_secret_version.default projects/{{project}}/secrets/{{secret_id}}/versions/{{version}}

[philip-harvey]

Since there is no way to provide a version number google_secret_manager_secret_version should set the value in the latest version, but it doesn't, which is the cause of the bug I'm reporting. This is supposed to be desired state, so terraform should keep the state per the config, but currently it doesn't for secrets

[edwardmedia]

@philip-harvey do you mean set the value in the latest version should be done in terraform apply? Usually apply is to bring your real settings and state to match your config, not the other way around. To bring your state to match your real settings, import is the way to go.

@c2thorn what do you think?

[c2thorn]

@philip-harvey I believe the behavior you want is in the data source https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/secret_manager_secret_version, not the resource.

In the data source, you can omit the version field to always retrieve the latest.

With the resource, you are managing a single version that gets assigned based on the payload from your first apply in step 1. Versions added outside of TF shouldn't affect the version that this resource is managing.

[philip-harvey]

Datasource doesn't help here, Terraform should be setting the real world state to match what is in the config. i.e. I expect that the serect data will be what is in secret_data, but this doesn't work currently. If the secret_data is changed outside of Terrafrom then Terraform will never fix it. I don't want to use a data source to get the latest version of the secret, I want Terraform to set the secret data to be the value in secret_data, this is currently broken.