terraform-provider-secrethub icon indicating copy to clipboard operation
terraform-provider-secrethub copied to clipboard

Add directories resource

Open jpcoenen opened this issue 4 years ago • 1 comments

Currently, SecretHub directories can only be created from the CLI or the Golang SDK. By adding support for the secrethub_dir resource to the provider, users can create SecretHub directories from within Terraform.

Some challenges that still have to be tackled:

  1. What happens when a user deletes a directory created in Terraform, but containing secrets that were created outside of Terraform?
  2. How do we handle the dependency of a secret on its directory: deleting or changing the path of a directory in TF should inform the user that all the containing Terraformed secrets are deleted.
  3. Can we implement this in a way that is forward compatible with a possible future function to move directories?

The first one could be solved by only allowing the deletion of empty directories and returning an error when this is not the case. The latter two can probably be tackled by changing the API to return the UUID of a directory and using it as the ID of the secrethub_dir resource.

jpcoenen avatar Jul 15 '20 12:07 jpcoenen

I've implemented in #121

I've tackled the challenges mentioned in this ticket in the following way:

  1. Deletion of non-empty directories is only allowed when force_destroy is set to true. Similar to the same option on AWS S3 bucket resource
  2. The path field has ForceNew specified. The plan will show how this cascades through to other resources.
  3. Secret resources currently use a path to specify in what directory secrets are created. To make secret resource compatible with move functionality, we'd have to make a breaking change, changing the dependency between secret and it's directory to be ID based. We don't want to make this breaking change right now. When we do, we can simultaneously change the dependency between directories themselves.

SimonBarendse avatar Jan 28 '21 20:01 SimonBarendse