terraform-provider-secrethub

README

Terraform Provider

The Terraform SecretHub Provider lets you manage your secrets using Terraform.

Usage

provider "secrethub" {
  # pass in credential or set SECRETHUB_CREDENTIAL environment variable
  credential = file("~/.secrethub/credential")
}

resource "secrethub_secret" "db_password" {
  path = "my-org/my-repo/db/password"

  generate {
    length      = 22
    use_symbols = true
  }
}

resource "secrethub_secret" "db_username" {
  path  = "my-org/my-repo/db/username"
  value = "db-user"
}

resource "aws_db_instance" "default" {
  allocated_storage    = 10
  storage_type         = "gp2"
  engine               = "mysql"
  engine_version       = "5.7"
  instance_class       = "db.t2.micro"
  name                 = "mydb"
  username             = secrethub_secret.db_username.value
  password             = secrethub_secret.db_password.value
  parameter_group_name = "default.mysql5.7"
}

Have a look at the reference docs for more information on the supported resources and data sources.

Get Started

Check out the step-by-step integration guide to get started.

A detailed use case is described in the original announcement. There are also some examples in this repo.

Support

If you need help, send us a message on the #terraform channel on Discord or send an email to terraform@secrethub.io

Development

Building

Get the source code:

git clone https://github.com/secrethub/terraform-provider-secrethub

Build it using:

make build

Testing

To run the acceptance tests, the following environment variables need to be set up.

• SECRETHUB_CREDENTIAL - a SecretHub credential.
• SECRETHUB_TF_ACC_NAMESPACE - a namespace registered on SecretHub. Make sure SECRETHUB_CREDENTIAL has admin access.
• SECRETHUB_TF_ACC_REPOSITORY - a repository within SECRETHUB_TF_ACC_NAMESPACE to be used in the acceptance tests. Make sure SECRETHUB_CREDENTIAL has admin access.
• SECRETHUB_TF_ACC_SECOND_ACCOUNT_NAME - an account other than the authenticated account, that is a member of the repository. It will be used to test access rules.
• SECRETHUB_TF_ACC_AWS_ROLE - an AWS IAM role to use for testing AWS service accounts. The role should have decrypt permission on the key in SECRETHUB_TF_ACC_AWS_KMS_KEY.
• SECRETHUB_TF_ACC_AWS_KMS_KEY - an AWS KMS key to use for testing AWS service accounts. The authenticated AWS user or role should have encrypt permission on this key and the SECRETHUB_TF_ACC_AWS_ROLE should have decrypt permission.

With the environment variables properly set up, run:

make testacc