Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ephemeral resource: add google_compute_ssl_certificate and google_compute_region_ssl_certificate support #20528

Open
avinashpancham opened this issue Dec 1, 2024 · 2 comments

Comments

@avinashpancham
Copy link

avinashpancham commented Dec 1, 2024

Community Note

  • Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
  • Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
  • If you are interested in working on this issue or have submitted a pull request, please leave a comment.
  • If an issue is assigned to a user, that user is claiming responsibility for the issue.
  • Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Description

We would like to use the new feature "ephemeral resources" for the resources google_compute_ssl_certificate and google_compute_region_ssl_certificate to prevent storing sensitive values for the attributes certificate and private key in the raw state as plain text

The Terraform docs for this resource state:

All arguments including the following potentially sensitive values will be stored in the raw state as plain text: certificate, private_key. [Read more about sensitive data in state](https://www.terraform.io/language/state/sensitive-data).

I would be open to help create this resource, I would need some guidance though.

New or Affected Resource(s)

  • google_compute_ssl_certificate
  • google_compute_region_ssl_certificate

Potential Terraform Configuration

ephemeral "google_compute_ssl_certificate" "this" {
  name            = "foo"
  private_key = "pvt-key-string"
  certificate    = "cert-string"
}

ephemeral "google_compute_regon_ssl_certificate" "this" {
  name            = "foo"
  region          = "europe-west4"
  private_key = "pvt-key-string"
  certificate    = "cert-string"
}

References

https://www.hashicorp.com/blog/terraform-1-10-improves-handling-secrets-in-state-with-ephemeral-values
https://developer.hashicorp.com/terraform/language/resources/ephemeral

@github-actions github-actions bot added forward/review In review; remove label to forward service/certificatemanager labels Dec 1, 2024
@rileykarson rileykarson added size/m forward/exempt Never forward this issue new-ephemeral-resource and removed forward/review In review; remove label to forward labels Dec 2, 2024
@rileykarson rileykarson added this to the Goals milestone Dec 2, 2024
@rileykarson
Copy link
Collaborator

Note: Forwarding exempt until we add docs for self-service contributors to add ephemeral resource support

@avinashpancham
Copy link
Author

What are the timlines to allow contributions?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants