Update Terraform secretsmanager to v1.3.0

[citygeo-bot]

This PR contains the following updates:

Package	Type	Update	Change
secretsmanager (source)	required_provider	minor	1.1.7 → 1.3.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

Keeper-Security/terraform-provider-secretsmanager (secretsmanager)

v1.3.0

Compare Source

Security

• Bump cloudflare/circl to v1.6.3 and grpc to v1.79.3 to address known vulnerabilities

Added

• Document Alpine Linux and musl-based container compatibility — all Linux binaries are statically compiled (CGO_ENABLED=0) with no C library dependencies and run on Alpine and other musl-based systems without modification (KSM-885)

• Custom fields in data sources and ephemeral resources (KSM-910):

  • Expose the custom block on all 22 record-type data sources (data "secretsmanager_<type>") — allows reading custom field values from existing vault records
  • Expose the custom block on all 22 record-type ephemeral resources (ephemeral "secretsmanager_<type>") — custom field values are returned without being stored in state
  • Each custom entry is a read-only block with type, label, value, required, and privacy_screen attributes
  • Completes KSM-388 custom field support across all three resource layers: managed resources (write), data sources (read), and ephemeral resources (read, no state)

• Ephemeral Resources (KSM-871):

  • Add ephemeral resource support for Terraform 1.10+, ensuring secrets are never stored in terraform.tfstate
  • Ephemeral resources available for all 25 record types: login, field, record, database_credentials, server_credentials, ssh_keys, encrypted_notes, address, bank_account, bank_card, birth_certificate, contact, driver_license, health_insurance, membership, passport, photo, software_license, ssn_card, file, pam_user, pam_machine, pam_database, pam_directory, pam_remote_browser
  • Use ephemeral "secretsmanager_<type>" "name" { ... } instead of data blocks to keep secrets out of state
  • Introduce Terraform Plugin Framework alongside existing SDKv2 via protocol v6 mux server
  • Add terraform-plugin-framework v1.18.0 and terraform-plugin-mux v0.22.0 dependencies
  • All existing resources and data sources remain fully backward compatible
  • Add documentation and examples for all ephemeral resources

• PAM Remote Browser (KSM-871):

  • Add secretsmanager_pam_remote_browser resource, data source, and ephemeral resource
  • Support for Remote Browser Isolation (RBI) URL, browser settings (JSON), traffic encryption seed, file references, and TOTP
  • Full CRUD lifecycle with import support

• Custom Fields (KSM-388):

  • Add custom block to all 23 record resource types (login, bank_account, bank_card, birth_certificate, contact, database_credentials, driver_license, encrypted_notes, file, health_insurance, membership, passport, photo, server_credentials, software_license, ssh_keys, ssn_card, address, pam_database, pam_directory, pam_machine, pam_remote_browser, pam_user)
  • Supports 43+ Keeper field types including text, secret, url, email, phone, date, birthDate, expirationDate, name, address, paymentCard, bankAccount, host, keyPair, securityQuestion, checkbox, multiline, and more
  • Simple types use a plain string value; complex types use value = jsonencode({...}) for a single entry or value = jsonencode([{...},{...}]) for multiple entries in one field
  • pam_machine and pam_user use merge-aware logic to preserve the vault-managed "Private Key Passphrase" custom field across create/update operations
  • required and privacy_screen attributes round-trip correctly from vault state (no perpetual diff on import)
  • Custom field schema verified across all 23 record resource types via unit test (folder excluded — it is a container with no custom fields); reference type SDK structs fixed (addressRef, cardRef, fileRef, oneTimeCode)

Fixed

• Custom fields — paymentCard perpetual diff (KSM-888):

  • jsonencode() values must use camelCase keys — cardNumber, cardExpirationDate, cardSecurityCode — matching Keeper's API format
  • Documentation now specifies camelCase requirement; snake_case keys silently produce empty objects, causing a perpetual plan diff (the old behavior)

• Custom fields — non-canonical checkbox values (KSM-889):

  • Only "true" or "false" are accepted for checkbox fields
  • Other strings like "yes", "1", or "on" now return a clear error instead of being silently coerced to false, which caused perpetual plan diffs

• Custom fields — non-canonical date values (KSM-889):

  • date, birthDate, and expirationDate only accept YYYY-MM-DD format
  • RFC3339 input (e.g., "2026-03-20T14:30:00Z") now returns a clear error instead of causing a perpetual plan diff (config kept RFC3339; state returned YYYY-MM-DD)
  • Updated documentation comments in record_fields.go and provider.go to correctly specify YYYY-MM-DD format

• PAM ephemeral host_name always empty (KSM-884):

  • pamHostnameToListValue was reading the wrong field key (hostname lowercase instead of hostName camelCase)
  • Fixes silent empty returns for pam_machine, pam_database, and pam_directory ephemeral resources

• Folder custom fields documentation (Code Review):

  • Removed spurious custom block from examples/resources/folder.tf and docs/resources/folder.md
  • KSM folders are containers and do not support custom fields

• Missing test coverage (Code Review):

  • Added resourceFile() to TestCustomFieldSchemaPresence — now covers all 23 record resource types (all except folder, which has no custom fields)
  • Verified all record resource types have custom TypeList with correct 5-key structure (type, label, value, required, privacy_screen)

• parseJSONItems panic guard (Code Review):

  • Added length check after strings.TrimSpace() to prevent index-out-of-range panic on empty or whitespace-only input
  • Affects custom field value parsing for complex types (phone, name, address, paymentCard, etc.)

• PAM Remote Browser example file (Code Review):

  • Created examples/resources/pam_remote_browser.tf demonstrating managed resource with custom block support

• secretsmanager_field ephemeral resource — wildcard path crash (KSM-915):

  • Using path = "*/field/login" with title caused apply to fail with "Provider produced invalid ephemeral resource instance — planned value does not match config value"
  • Terraform Plugin Framework enforces that Required (non-Computed) attributes cannot be mutated by the provider; the resolved UID was being written back to path in violation of this rule
  • Fix: remove the internal path write-back; value is the only attribute that needs to be set in the result

• Custom fields — type case normalization and validation (KSM-908):

  • Custom field type input is now case-insensitive; any casing (e.g., "paymentcard", "PaymentCard", "PAYMENTCARD") is accepted and normalized to canonical vault API casing — no perpetual diff
  • Unknown type strings are now rejected at plan time with a clear error listing all valid types
  • Fixes lowercase variants (e.g., type = "paymentcard") being silently stored as core.Text instead of the correct SDK type (e.g., core.PaymentCards)

• Remove invalid DiffSuppressFunc and ValidateFunc from computed-only pam_remote_browser_settings field in the pam_remote_browser data source

• Add nil-check guard in all ephemeral resource Open() methods to prevent panics if provider configuration is missing

• Surface warning diagnostics when referenced addressRef or cardRef records cannot be fetched, instead of silently returning empty fields

• Mark credential provider attribute as sensitive to prevent credentials appearing in plan output

• Mark sensitive fields across all record types to prevent secrets appearing in plan output: payment card numbers and security codes, bank account and routing numbers, PIN codes, TOTP seeds, license numbers, and secret field values

v1.2.0

Compare Source

Security

• Upgrade Go from 1.24.0 to 1.24.13 to address critical vulnerabilities

Added

• SSH Key Generation (KSM-788):

  • Add automatic SSH key pair generation to secretsmanager_ssh_keys resource
  • Support ED25519, RSA (2048/3072/4096), and ECDSA (P-256/P-384/P-521) key types
  • Generate SSH keys via generate = "yes" on key_pair block
  • Automatic private key encryption with passphrase using OpenSSH bcrypt+aes256-ctr format
  • Add unit tests for all key types and acceptance tests for ED25519 and RSA+passphrase
  • Update documentation with generation examples and key type options

• PAM SSH Key Generation (KSM-789):

  • Add SSH key generation support to PAM User and Machine resources
  • Add private_pem_key field (standard secret) to secretsmanager_pam_user and secretsmanager_pam_machine
  • Add private_key_passphrase field (custom secret) for encrypted key storage
  • Generate SSH keys via generate = "yes" on private_pem_key block
  • Support same key types as ssh_keys resource (ED25519, RSA, ECDSA)
  • Passphrase stored as custom field for kdnrm PAM interoperability
  • Add comprehensive documentation for pam_user and pam_machine SSH key generation

• PAM Record Type Support (KSM-527):

  • Add secretsmanager_pam_machine resource and data source for SSH, RDP, and remote machine credentials
  • Add secretsmanager_pam_database resource and data source for PostgreSQL, MySQL, MongoDB, and database credentials
  • Add secretsmanager_pam_directory resource and data source for Active Directory and LDAP credentials
  • Enhanced secretsmanager_pam_user data source with private_pem_key field support
  • Add pamSettings field for protocol-specific connection configuration as JSON
  • PAM-specific fields use flat value syntax consistent with standard fields: database_type = "postgresql", directory_type = "Active Directory", use_ssl { value = true }
  • Add schema functions in record_fields_pam.go for PAM-specific fields
  • Add 21 acceptance tests covering full CRUD lifecycle, data source field readback, and auto-generated UID for all 4 PAM types
  • Add data source documentation for all 4 PAM types (pam_machine, pam_database, pam_directory, pam_user)
  • Add 6 comprehensive example files demonstrating PAM resource and data source usage

• Regex Pattern Support (KSM-389):

  • Add title_patterns parameter to secretsmanager_records data source for filtering with Go regex
  • Support multiple patterns in a single query
  • Combine with existing UIDs and exact title filters
  • Add ReDoS protection with 500-character pattern length limit
  • Add 5 new acceptance tests for pattern matching functionality (including length validation)
  • Update documentation with regex pattern examples, performance warnings, and security considerations

• Add GitHub Actions workflow for automated testing on pull requests

• Add explicit contents: read permissions to test workflow for security compliance

Fixed

• Fix PAM pam_settings field readback for PAM data sources and PAM Machine resource lifecycle handling (KSM-796)
• Fix PAM Machine data source missing login, password, private_pem_key, private_key_passphrase, and ssl_verification fields (KSM-797)
• Fix PAM data source coverage gaps for folder_uid, totp, and PAM User private_key_passphrase readback (KSM-798)
• Fix PAM User data source returning empty values for connect_database and private_pem_key fields (KSM-794)
• Fix shortcuts/linked records error (KSM-522) - resolve duplicate UID handling across multiple shared folders
• Fix "changes to folder_uid not allowed" errors during Terraform apply operations
• Use reflect.DeepEqual for JSON comparison to handle map ordering correctly instead of string comparison
• Fix test helpers in data_source_records_test.go (ProviderFactories → Providers)
• Use t.Skip() instead of t.Fatal() for missing test setup to prevent CI failures

Changed

• Resource Documentation Improvements (KSM-790):
  • Update 18 resource documentation files to clarify resources "create and manage" secrets (not just "access")
  • Add "Example Usage" sections with working Terraform code samples from examples directory
  • Improve clarity around resource CRUD lifecycle capabilities
  • Resources updated: address, bank_account, bank_card, birth_certificate, contact, database_credentials, driver_license, encrypted_notes, file, health_insurance, login, membership, passport, photo, server_credentials, software_license, ssh_keys, ssn_card
• Clarify folder_uid description to reflect sub-folder support (parent shared folder access sufficient)
• Clarify checkbox field comment to explain Keeper stores values as single-element arrays
• Add Go version compatibility flag (-compat=1.24.13) to goreleaser config

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Terraform plan output for ./terraform/env/dev

Contains changes: yes

Show Plan

Terraform will perform the following actions:

  # module.flex_gateway.aws_s3_bucket_server_side_encryption_configuration.main will be updated in-place
  ~ resource "aws_s3_bucket_server_side_encryption_configuration" "main" {
        id                    = "phl-citygeo-flex-gateway-dev"
        # (3 unchanged attributes hidden)

      - rule {
          # At least one attribute in this block is (or was) sensitive,
          # so its contents will not be displayed.
        }
      + rule {
          # At least one attribute in this block is (or was) sensitive,
          # so its contents will not be displayed.
        }
    }

  # module.flex_gateway.aws_s3_object.registration will be updated in-place
  ~ resource "aws_s3_object" "registration" {
      ~ content_base64                = (sensitive value)
        id                            = "phl-citygeo-flex-gateway-dev/registration.yaml"
        tags                          = {}
      + version_id                    = (known after apply)
        # (25 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

Pusher: @citygeo-bot[bot]

[github-actions]

Terraform plan output for ./terraform/env/prod

Contains changes: yes

Show Plan

Terraform will perform the following actions:

  # module.flex_gateway.aws_s3_bucket_server_side_encryption_configuration.main will be updated in-place
  ~ resource "aws_s3_bucket_server_side_encryption_configuration" "main" {
        id                    = "phl-citygeo-flex-gateway-prod"
        # (3 unchanged attributes hidden)

      - rule {
          # At least one attribute in this block is (or was) sensitive,
          # so its contents will not be displayed.
        }
      + rule {
          # At least one attribute in this block is (or was) sensitive,
          # so its contents will not be displayed.
        }
    }

  # module.flex_gateway.aws_s3_object.registration will be updated in-place
  ~ resource "aws_s3_object" "registration" {
      ~ content_base64                = (sensitive value)
        id                            = "phl-citygeo-flex-gateway-prod/registration.yaml"
        tags                          = {}
      + version_id                    = (known after apply)
        # (25 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

Pusher: @citygeo-bot[bot]

[github-actions]

Terraform plan output for ./terraform/common

Contains changes: no

Show Plan

data.aws_caller_identity.current: Reading...
data.aws_caller_identity.current: Read complete after 0s [id=975050025792]
aws_kms_key.common: Refreshing state... [id=3d75e1a1-78eb-42a2-80fe-9efc9e5a64b4]
aws_kms_alias.common: Refreshing state... [id=alias/mulesoft]
aws_ssm_parameter.kms_id: Refreshing state... [id=/mulesoft/common/kms_id]
aws_ssm_parameter.kms_arn: Refreshing state... [id=/mulesoft/common/kms_arn]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

Pusher: @citygeo-bot[bot]

[github-actions]

Terraform plan output for ./terraform/env/test

Contains changes: yes

Show Plan

Terraform will perform the following actions:

  # module.flex_gateway.aws_s3_bucket_server_side_encryption_configuration.main will be updated in-place
  ~ resource "aws_s3_bucket_server_side_encryption_configuration" "main" {
        id                    = "phl-citygeo-flex-gateway-test"
        # (3 unchanged attributes hidden)

      - rule {
          # At least one attribute in this block is (or was) sensitive,
          # so its contents will not be displayed.
        }
      + rule {
          # At least one attribute in this block is (or was) sensitive,
          # so its contents will not be displayed.
        }
    }

  # module.flex_gateway.aws_s3_object.registration will be updated in-place
  ~ resource "aws_s3_object" "registration" {
      ~ content_base64                = (sensitive value)
        id                            = "phl-citygeo-flex-gateway-test/registration.yaml"
        tags                          = {}
      + version_id                    = (known after apply)
        # (26 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

Pusher: @citygeo-bot[bot]

[citygeo-bot]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.