terraform-provider-secrethub

README

Provider^BETA

The Terraform SecretHub Provider lets you manage your secrets using Terraform.

SecretHub is an end-to-end encrypted secret management service that helps developers keep database passwords, API keys, and other secrets out of source code.

Usage

provider "secrethub" {
  # pass in credential or set SECRETHUB_CREDENTIAL environment variable
  credential = "${file("~/.secrethub/credential")}" 
}

resource "secrethub_secret" "db_password" {
  path = "my-org/my-repo/db/password"

  generate {
    length      = 22
    use_symbols = true
  }
}

resource "secrethub_secret" "db_username" {
  path = "my-org/my-repo/db/username"
  value = "db-user"
}

resource "aws_db_instance" "default" {
  allocated_storage    = 10
  storage_type         = "gp2"
  engine               = "mysql"
  engine_version       = "5.7"
  instance_class       = "db.t2.micro"
  name                 = "mydb"
  username             = "${secrethub_secret.db_username.value}"
  password             = "${secrethub_secret.db_password.value}"
  parameter_group_name = "default.mysql5.7"
}

Have a look at the reference docs for more information on the supported resources and data sources.

Get Started

Check out the step-by-step integration guide to get started.

A detailed use case is described in the beta announcement. There are also some examples in this repo.

BETA

This project is currently in beta and we'd love your feedback! Check out the issues and feel free suggest cool ideas, use cases, or improvements.

Because it's still in beta, you can expect to see some changes introduced. Pull requests are very welcome.

For support, send us a message on the #terraform channel on Discord or send an email to terraform@secrethub.io

Development

Building

Get the source code:

git clone https://github.com/secrethub/terraform-provider-secrethub

Build it using:

make build

Testing

To run the acceptance tests, the following environment variables need to be set up.

• SECRETHUB_CREDENTIAL - a SecretHub credential.
• SECRETHUB_TF_ACC_NAMESPACE - a namespace registered on SecretHub. Make sure SECRETHUB_CREDENTIAL has admin access.
• SECRETHUB_TF_ACC_REPOSITORY - a repository within SECRETHUB_TF_ACC_NAMESPACE to be used in the acceptance tests. Make sure SECRETHUB_CREDENTIAL has admin access.
• SECRETHUB_TF_ACC_SECOND_ACCOUNT_NAME - an account other than the authenticated account, that is a member of the repository. It will be used to test access rules.
• SECRETHUB_TF_ACC_AWS_ROLE - an AWS IAM role to use for testing AWS service accounts. The role should have decrypt permission on the key in SECRETHUB_TF_ACC_AWS_KMS_KEY.
• SECRETHUB_TF_ACC_AWS_KMS_KEY - an AWS KMS key to use for testing AWS service accounts. The authenticated AWS user or role should have encrypt permission on this key and the SECRETHUB_TF_ACC_AWS_ROLE should have decrypt permission.

With the environment variables properly set up, run:

make testacc