{"id":24233742,"url":"https://github.com/memes/terraform-google-secret-manager","last_synced_at":"2025-11-29T18:05:22.370Z","repository":{"id":37960084,"uuid":"305765058","full_name":"memes/terraform-google-secret-manager","owner":"memes","description":"A Terraform module for creating GCP Secret Manager secrets and assigning read-permissions to them","archived":false,"fork":false,"pushed_at":"2025-08-25T17:54:05.000Z","size":304,"stargazers_count":3,"open_issues_count":1,"forks_count":13,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-08-25T18:23:02.615Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/memes.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2020-10-20T16:13:32.000Z","updated_at":"2025-08-25T17:54:08.000Z","dependencies_parsed_at":"2023-10-02T19:41:51.422Z","dependency_job_id":"301194ab-1621-49bd-b094-31b4dec4efe2","html_url":"https://github.com/memes/terraform-google-secret-manager","commit_stats":null,"previous_names":[],"tags_count":20,"template":false,"template_full_name":null,"purl":"pkg:github/memes/terraform-google-secret-manager","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/memes%2Fterraform-google-secret-manager","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/memes%2Fterraform-google-secret-manager/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/memes%2Fterraform-google-secret-manager/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/memes%2Fterraform-google-secret-manager/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/memes","download_url":"https://codeload.github.com/memes/terraform-google-secret-manager/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/memes%2Fterraform-google-secret-manager/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":27360780,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-11-29T02:00:06.589Z","response_time":56,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-01-14T16:01:40.871Z","updated_at":"2025-11-29T18:05:22.363Z","avatar_url":"https://github.com/memes.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Secret Manager for Terraform 0.14+\n\n![GitHub release](https://img.shields.io/github/v/release/memes/terraform-google-secret-manager?sort=semver)\n![Maintenance](https://img.shields.io/maintenance/yes/2025)\n[![Contributor Covenant](https://img.shields.io/badge/Contributor%20Covenant-2.1-4baaaa.svg)](CODE_OF_CONDUCT.md)\n\nThis module provides an opinionated wrapper around creating and managing secret values\nin GCP [Secret Manager](https://cloud.google.com/secret-manager) with Terraform\n0.14 and newer.\n\n\u003e NOTE: The random sub-module has been removed from v2.x releases; use Terraform's\n\u003e random provider or other method to generate a suitable secret password.\n\u003e See [Random provider](examples/with-random-provider/) for an example.\n\nGiven a project identifier, the module will create a new secret, or update an\nexisting secret version, so that it contains the value provided. An optional list\nof IAM user, group, or service account identifiers can be provided and each of\nthe identifiers will be granted `roles/secretmanager.secretAccessor` on the secret.\n\n\u003c!-- spell-checker: disable --\u003e\n```hcl\nmodule \"secret\" {\n  source     = \"memes/secret-manager/google\"\n  version    = \"2.2.2\"\n  project_id = \"my-project-id\"\n  id         = \"my-secret\"\n  secret     = \"T0pS3cret!\"\n  accessors  = [\"group:team@example.com\"]\n}\n```\n\u003c!-- spell-checker: enable --\u003e\n\nThere are a set of examples that help show the various options available:\n\n* [Simple](examples/simple/) - minimal use-case that creates a secret with a value.\n* [Empty Secret](examples/empty-secret-value/) - use-case that creates a secret but does not assign a value; e.g. the\n   module does not a secret version.\n* [Random provider](examples/with-random-provider/) - demonstrates using the Terraform Random provider to create a\n  random secret value.\n* [Accessors](examples/accessors/) - use-case to create a secret and with read-only role granted to a set of accounts.\n* [User-managed replication](examples/user-managed-replication/) - override Google Secret Manager automatic replication\n  with a fixed set of regions.\n* [User-managed replication with Cloud KMS](examples/user-managed-replication-with-keys/) - force Google Secret Manager\n  to replication to a fixed set of regions *and* use specified Cloud KMS keys for the encryption.\n* [All Options](examples/all-options/) - use-case with user managed replication options, assigned roles, etc. The kitchen\n  sink!\n* [Automatic replication with Cloud KMS](examples/auto-replication-with-key/) - *New in v2.2.0* - use Google Secret Manager\n  automatic replication of secret, but encrypt with the specified Cloud KMS key.\n* [Pub/Sub integration](examples/pubsub/) - *New in v2.2.0* - create a Secret with integration to an existing Cloud Pub/Sub\n  Topic; Secret Manager will inform listeners of rotation and life-cycle events.\n* [Time-to-live](examples/ttl/) - *New in v2.2.0* - create a Secret with a fixed TTL; after this time the Secret will be\n  automatically destroyed.\n\n\u003c!-- markdownlint-disable MD033 MD034--\u003e\n\u003c!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 0.14.5 |\n| \u003ca name=\"requirement_google\"\u003e\u003c/a\u003e [google](#requirement\\_google) | \u003e= 4.83 |\n\n## Modules\n\nNo modules.\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [google_secret_manager_secret.secret](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/secret_manager_secret) | resource |\n| [google_secret_manager_secret_iam_member.secret](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/secret_manager_secret_iam_member) | resource |\n| [google_secret_manager_secret_version.secret](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/secret_manager_secret_version) | resource |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_id\"\u003e\u003c/a\u003e [id](#input\\_id) | The secret identifier to create; this value must be unique within the project. | `string` | n/a | yes |\n| \u003ca name=\"input_project_id\"\u003e\u003c/a\u003e [project\\_id](#input\\_project\\_id) | The GCP project identifier where the secret will be created. | `string` | n/a | yes |\n| \u003ca name=\"input_secret\"\u003e\u003c/a\u003e [secret](#input\\_secret) | The secret payload to store in Secret Manager; if blank or null a versioned secret\u003cbr\u003evalue will NOT be created and must be populated outside of this module. Binary\u003cbr\u003evalues should be base64 encoded before use. | `string` | n/a | yes |\n| \u003ca name=\"input_accessors\"\u003e\u003c/a\u003e [accessors](#input\\_accessors) | An optional list of IAM account identifiers that will be granted accessor (read-only)\u003cbr\u003epermission to the secret. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_annotations\"\u003e\u003c/a\u003e [annotations](#input\\_annotations) | An optional map of annotation key:value pairs to assign to the secret resources.\u003cbr\u003eDefault is an empty map. | `map(string)` | `{}` | no |\n| \u003ca name=\"input_auto_replication_kms_key_name\"\u003e\u003c/a\u003e [auto\\_replication\\_kms\\_key\\_name](#input\\_auto\\_replication\\_kms\\_key\\_name) | An optional Cloud KMS key name to use with Google managed replication. If the value is empty (default), then a Google\u003cbr\u003emanaged key will be used for encryption of the secret. See `replication` variable for examples. | `string` | `\"\"` | no |\n| \u003ca name=\"input_labels\"\u003e\u003c/a\u003e [labels](#input\\_labels) | An optional map of label key:value pairs to assign to the secret resources.\u003cbr\u003eDefault is an empty map. | `map(string)` | `{}` | no |\n| \u003ca name=\"input_replication\"\u003e\u003c/a\u003e [replication](#input\\_replication) | An optional map of replication configurations for the secret. If the map is empty\u003cbr\u003e(default), then automatic replication will be used for the secret. If the map is\u003cbr\u003enot empty, replication will be configured for each key (region) and, optionally,\u003cbr\u003ewill use the provided Cloud KMS keys.\u003cbr\u003e\u003cbr\u003eNOTE: If Cloud KMS keys are used, a Cloud KMS key must be provided for every\u003cbr\u003eregion key.\u003cbr\u003e\u003cbr\u003eE.g. to use automatic replication policy with Google managed keys(default)\u003cbr\u003ereplication = {}\u003cbr\u003e\u003cbr\u003eE.g. to use automatic replication policy with specific Cloud KMS key,\u003cbr\u003eauto\\_replication\\_kms\\_key\\_name = \"my-global-key-name\"\u003cbr\u003ereplication = {}\u003cbr\u003e\u003cbr\u003eE.g. to force secrets to be replicated only in us-east1 and us-west1 regions,\u003cbr\u003ewith Google managed encryption keys\u003cbr\u003ereplication = {\u003cbr\u003e  \"us-east1\" = null\u003cbr\u003e  \"us-west1\" = null\u003cbr\u003e}\u003cbr\u003e\u003cbr\u003eE.g. to force secrets to be replicated only in us-east1 and us-west1 regions, but\u003cbr\u003euse Cloud KMS keys from each region.\u003cbr\u003ereplication = {\u003cbr\u003e  \"us-east1\" = { kms\\_key\\_name = \"my-east-key-name\" }\u003cbr\u003e  \"us-west1\" = { kms\\_key\\_name = \"my-west-key-name\" }\u003cbr\u003e} | \u003cpre\u003emap(object({\u003cbr\u003e    kms_key_name = string\u003cbr\u003e  }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_topics\"\u003e\u003c/a\u003e [topics](#input\\_topics) | An optional list of Cloud Pub/Sub topics that will receive control-plane events for the secret.\u003cbr\u003eDefault is an empty list. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_ttl_secs\"\u003e\u003c/a\u003e [ttl\\_secs](#input\\_ttl\\_secs) | An optional time-to-live value expressed as a number of seconds; the secret will be automatically deleted after this\u003cbr\u003eduration. If the value is null (default), there will be no time-to-live applied to the secret.\u003cbr\u003e\u003cbr\u003eE.g. to automatically delete the secret after 5 minutes, set\u003cbr\u003ettl\\_secs = 600 | `number` | `null` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_expiration_timestamp\"\u003e\u003c/a\u003e [expiration\\_timestamp](#output\\_expiration\\_timestamp) | The RFC3339 formatted timestamp when the secret will automatically be removed from Secret Manager, if applicable. |\n| \u003ca name=\"output_id\"\u003e\u003c/a\u003e [id](#output\\_id) | The fully-qualified id of the Secret Manager key that contains the secret. |\n| \u003ca name=\"output_secret_id\"\u003e\u003c/a\u003e [secret\\_id](#output\\_secret\\_id) | The project-local id Secret Manager key that contains the secret. Should match\u003cbr\u003ethe input `id`. |\n\u003c!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n\u003c!-- markdownlint-enable MD033 MD034 --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmemes%2Fterraform-google-secret-manager","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmemes%2Fterraform-google-secret-manager","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmemes%2Fterraform-google-secret-manager/lists"}