Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/googlecloudplatform/terraform-google-secret-manager

Creates one or more Google Secret Manager secrets and manages basic permissions for them
https://github.com/googlecloudplatform/terraform-google-secret-manager

cft-terraform gcp kms pubsub security-identity terraform-module

Last synced: 7 days ago
JSON representation

Creates one or more Google Secret Manager secrets and manages basic permissions for them

Host: GitHub
URL: https://github.com/googlecloudplatform/terraform-google-secret-manager
Owner: GoogleCloudPlatform
License: apache-2.0
Created: 2022-05-11T18:06:55.000Z (over 2 years ago)
Default Branch: main
Last Pushed: 2024-12-09T15:18:55.000Z (about 1 month ago)
Last Synced: 2024-12-18T08:41:29.493Z (about 1 month ago)
Topics: cft-terraform, gcp, kms, pubsub, security-identity, terraform-module
Language: HCL
Homepage: https://registry.terraform.io/modules/GoogleCloudPlatform/secret-manager/google
Size: 416 KB
Stars: 42
Watchers: 27
Forks: 32
Open Issues: 5
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Codeowners: CODEOWNERS
- Security: SECURITY.md

Awesome Lists containing this project

README

        # terraform-google-secret-manager

This modules makes it easy to create Google Secret Manager secrets. If enabled it can enable the use of KMS keys for encrypting the secrets. Also if rotation is enabled and pubsub topics are passed in, then notification about secret rotation are sent to the pubsub topics. Here is a diagram of the resources that are deployed:

![arch_diagram](./assets/tf-secrets.png)

## Usage

Basic usage of this module is as follows:

```hcl

module "secret-manager" {

  source  = "GoogleCloudPlatform/secret-manager/google"

  version = "~> 0.7"

  project_id = var.project_id

  secrets = [

    {

      name                     = "secret-1"

      secret_data              = "secret information"

    },

  ]

}

```

Functional examples are included in the [examples](./examples/) directory.

## Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

| add\_kms\_permissions | The list of the crypto keys to give secret manager access to | `list(string)` | `[]` | no |

| add\_pubsub\_permissions | The list of the pubsub topics to give secret manager access to | `list(string)` | `[]` | no |

| automatic\_replication | Automatic replication parameters that will be used for defined secrets. If not provided, the secret will be automatically replicated using Google-managed key without any restrictions. | `map(object({ kms_key_name = string }))` | `{}` | no |

| labels | labels to be added for the defined secrets | `map(map(string))` | `{}` | no |

| project\_id | The project ID to manage the Secret Manager resources | `string` | n/a | yes |

| secret\_accessors\_list | The list of the members to allow accessing secrets | `list(string)` | `[]` | no |

| secrets | The list of the secrets | 
list(object({
    name : string,
    secret_data : optional(string),
    next_rotation_time : optional(string),
    rotation_period : optional(string),
    create_version : optional(bool, true)
  })) | `[]` | no |

| topics | topics that will be used for defined secrets | `map(list(object({ name = string })))` | `{}` | no |

| user\_managed\_replication | Replication parameters that will be used for defined secrets | `map(list(object({ location = string, kms_key_name = string })))` | `{}` | no |

## Outputs

| Name | Description |

|------|-------------|

| secret\_names | The name list of Secrets |

| secret\_versions | The name list of Secret Versions |

## Requirements

These sections describe requirements for using this module.

### Software

The following dependencies must be available:

- [Terraform][terraform] v0.13

- [Terraform Provider for GCP][terraform-provider-gcp] plugin v3.0

### Service Account

A service account with the following roles must be used to provision

the resources of this module:

- Secret Manager Admin: `roles/secretmanager.admin`

If you want the module to change IAM permissions (for the pubsub and kms use cases), it will require the following additional roles:

- Project IAM Admin: `roles/resourcemanager.projectIamAdmin`

The [Project Factory module][project-factory-module] and the

[IAM module][iam-module] may be used in combination to provision a

service account with the necessary roles applied.

### APIs

A project with the following APIs enabled must be used to host the

resources of this module:

- Secret Manager API: `secretmanager.googleapis.com`

The [Project Factory module][project-factory-module] can be used to

provision a project with the necessary APIs enabled.

## Contributing

Refer to the [contribution guidelines](./CONTRIBUTING.md) for

information on contributing to this module.

[iam-module]: https://registry.terraform.io/modules/terraform-google-modules/iam/google

[project-factory-module]: https://registry.terraform.io/modules/terraform-google-modules/project-factory/google

[terraform-provider-gcp]: https://www.terraform.io/docs/providers/google/index.html

[terraform]: https://www.terraform.io/downloads.html

## Security Disclosures

Please see our [security disclosure process](./SECURITY.md).