Update Terraform secretsmanager to v1.3.0 - #15
Open
citygeo-bot[bot] wants to merge 1 commit into
Open
Conversation
citygeo-bot
Bot
force-pushed
the
renovate/secretsmanager-1.x
branch
from
April 24, 2026 16:31
84dc173 to
eb07b3d
Compare
citygeo-bot
Bot
changed the title
Terraform plan output for
|
Terraform plan output for
|
Terraform plan output for
|
Terraform plan output for
|
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.1.7→1.3.0Release Notes
Keeper-Security/terraform-provider-secretsmanager (secretsmanager)
v1.3.0Compare Source
Security
cloudflare/circlto v1.6.3 andgrpcto v1.79.3 to address known vulnerabilitiesAdded
Document Alpine Linux and musl-based container compatibility — all Linux binaries are statically compiled (
CGO_ENABLED=0) with no C library dependencies and run on Alpine and other musl-based systems without modification (KSM-885)Custom fields in data sources and ephemeral resources (KSM-910):
customblock on all 22 record-type data sources (data "secretsmanager_<type>") — allows reading custom field values from existing vault recordscustomblock on all 22 record-type ephemeral resources (ephemeral "secretsmanager_<type>") — custom field values are returned without being stored in statecustomentry is a read-only block withtype,label,value,required, andprivacy_screenattributesEphemeral Resources (KSM-871):
terraform.tfstatelogin,field,record,database_credentials,server_credentials,ssh_keys,encrypted_notes,address,bank_account,bank_card,birth_certificate,contact,driver_license,health_insurance,membership,passport,photo,software_license,ssn_card,file,pam_user,pam_machine,pam_database,pam_directory,pam_remote_browserephemeral "secretsmanager_<type>" "name" { ... }instead ofdatablocks to keep secrets out of stateterraform-plugin-frameworkv1.18.0 andterraform-plugin-muxv0.22.0 dependenciesPAM Remote Browser (KSM-871):
secretsmanager_pam_remote_browserresource, data source, and ephemeral resourceCustom Fields (KSM-388):
customblock to all 23 record resource types (login,bank_account,bank_card,birth_certificate,contact,database_credentials,driver_license,encrypted_notes,file,health_insurance,membership,passport,photo,server_credentials,software_license,ssh_keys,ssn_card,address,pam_database,pam_directory,pam_machine,pam_remote_browser,pam_user)text,secret,url,email,phone,date,birthDate,expirationDate,name,address,paymentCard,bankAccount,host,keyPair,securityQuestion,checkbox,multiline, and morevalue; complex types usevalue = jsonencode({...})for a single entry orvalue = jsonencode([{...},{...}])for multiple entries in one fieldpam_machineandpam_useruse merge-aware logic to preserve the vault-managed "Private Key Passphrase" custom field across create/update operationsrequiredandprivacy_screenattributes round-trip correctly from vault state (no perpetual diff on import)folderexcluded — it is a container with no custom fields); reference type SDK structs fixed (addressRef,cardRef,fileRef,oneTimeCode)Fixed
Custom fields —
paymentCardperpetual diff (KSM-888):jsonencode()values must use camelCase keys —cardNumber,cardExpirationDate,cardSecurityCode— matching Keeper's API formatCustom fields — non-canonical
checkboxvalues (KSM-889):"true"or"false"are accepted for checkbox fields"yes","1", or"on"now return a clear error instead of being silently coerced tofalse, which caused perpetual plan diffsCustom fields — non-canonical date values (KSM-889):
date,birthDate, andexpirationDateonly accept YYYY-MM-DD format"2026-03-20T14:30:00Z") now returns a clear error instead of causing a perpetual plan diff (config kept RFC3339; state returned YYYY-MM-DD)record_fields.goandprovider.goto correctly specify YYYY-MM-DD formatPAM ephemeral
host_namealways empty (KSM-884):pamHostnameToListValuewas reading the wrong field key (hostnamelowercase instead ofhostNamecamelCase)pam_machine,pam_database, andpam_directoryephemeral resourcesFolder custom fields documentation (Code Review):
customblock fromexamples/resources/folder.tfanddocs/resources/folder.mdMissing test coverage (Code Review):
resourceFile()toTestCustomFieldSchemaPresence— now covers all 23 record resource types (all exceptfolder, which has no custom fields)customTypeList with correct 5-key structure (type, label, value, required, privacy_screen)parseJSONItems panic guard (Code Review):
strings.TrimSpace()to prevent index-out-of-range panic on empty or whitespace-only inputPAM Remote Browser example file (Code Review):
examples/resources/pam_remote_browser.tfdemonstrating managed resource withcustomblock supportsecretsmanager_fieldephemeral resource — wildcard path crash (KSM-915):path = "*/field/login"withtitlecaused apply to fail with "Provider produced invalid ephemeral resource instance — planned value does not match config value"Required(non-Computed) attributes cannot be mutated by the provider; the resolved UID was being written back topathin violation of this rulevalueis the only attribute that needs to be set in the resultCustom fields — type case normalization and validation (KSM-908):
typeinput is now case-insensitive; any casing (e.g.,"paymentcard","PaymentCard","PAYMENTCARD") is accepted and normalized to canonical vault API casing — no perpetual difftype = "paymentcard") being silently stored ascore.Textinstead of the correct SDK type (e.g.,core.PaymentCards)Remove invalid
DiffSuppressFuncandValidateFuncfrom computed-onlypam_remote_browser_settingsfield in thepam_remote_browserdata sourceAdd nil-check guard in all ephemeral resource
Open()methods to prevent panics if provider configuration is missingSurface warning diagnostics when referenced
addressReforcardRefrecords cannot be fetched, instead of silently returning empty fieldsMark
credentialprovider attribute as sensitive to prevent credentials appearing in plan outputMark sensitive fields across all record types to prevent secrets appearing in plan output: payment card numbers and security codes, bank account and routing numbers, PIN codes, TOTP seeds, license numbers, and secret field values
v1.2.0Compare Source
Security
Added
SSH Key Generation (KSM-788):
secretsmanager_ssh_keysresourceED25519, RSA (2048/3072/4096), and ECDSA (P-256/P-384/P-521) key typesgenerate = "yes"onkey_pairblockED25519and RSA+passphrasePAM SSH Key Generation (KSM-789):
private_pem_keyfield (standard secret) tosecretsmanager_pam_userandsecretsmanager_pam_machineprivate_key_passphrasefield (custom secret) for encrypted key storagegenerate = "yes"onprivate_pem_keyblockED25519, RSA, ECDSA)PAM Record Type Support (KSM-527):
secretsmanager_pam_machineresource and data source for SSH, RDP, and remote machine credentialssecretsmanager_pam_databaseresource and data source for PostgreSQL, MySQL, MongoDB, and database credentialssecretsmanager_pam_directoryresource and data source for Active Directory and LDAP credentialssecretsmanager_pam_userdata source withprivate_pem_keyfield supportpamSettingsfield for protocol-specific connection configuration as JSONdatabase_type = "postgresql",directory_type = "Active Directory",use_ssl { value = true }record_fields_pam.gofor PAM-specific fieldspam_machine,pam_database,pam_directory,pam_user)Regex Pattern Support (KSM-389):
title_patternsparameter tosecretsmanager_recordsdata source for filtering with Go regexAdd GitHub Actions workflow for automated testing on pull requests
Add explicit
contents: readpermissions to test workflow for security complianceFixed
pam_settingsfield readback for PAM data sources and PAM Machine resource lifecycle handling (KSM-796)login,password,private_pem_key,private_key_passphrase, andssl_verificationfields (KSM-797)folder_uid,totp, and PAM Userprivate_key_passphrasereadback (KSM-798)connect_databaseandprivate_pem_keyfields (KSM-794)reflect.DeepEqualfor JSON comparison to handle map ordering correctly instead of string comparisondata_source_records_test.go(ProviderFactories → Providers)t.Skip()instead oft.Fatal()for missing test setup to prevent CI failuresChanged
folder_uiddescription to reflect sub-folder support (parent shared folder access sufficient)-compat=1.24.13) to goreleaser configConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.