[DEVOPS-4425] feat: add ephemeral resources for creds and certs

.github/workflows/test.yml

@@ -44,6 +44,11 @@ jobs:
           go-version-file: go.mod
           cache: true
 
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v4
+        with:
+          terraform_wrapper: false
+
       - name: Run acceptance tests
         run: go test ./internal/provider/ -v -timeout 120m
         env:

README.md

@@ -12,7 +12,7 @@ Terraform Provider for managing your Devolutions Server instance.
 
 ## Requirements
 
-- [Terraform](https://www.terraform.io/downloads.html) >= 1.0
+- [Terraform](https://www.terraform.io/downloads.html) >= 1.0 (>= 1.10 required to use ephemeral resources)
 - [Go](https://golang.org/doc/install) >= 1.26
 - [Devolutions Server](https://devolutions.net/server) >= 2026.x
 

docs/ephemeral-resources/entry_certificate.md

@@ -0,0 +1,57 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "dvls_entry_certificate Ephemeral Resource - terraform-provider-dvls"
+subcategory: ""
+description: |-
+  A DVLS Certificate Entry, fetched ephemerally so the certificate file and password never land in Terraform state.
+---
+
+# dvls_entry_certificate (Ephemeral Resource)
+
+A DVLS Certificate Entry, fetched ephemerally so the certificate file and password never land in Terraform state.
+
+## Example Usage
+
+```terraform
+# Certificate file content and password are fetched only during plan/apply
+# and never stored in Terraform state. Lookup is by ID only.
+ephemeral "dvls_entry_certificate" "by_id" {
+  id = "00000000-0000-0000-0000-000000000000"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `id` (String) Certificate ID
+
+### Read-Only
+
+- `description` (String) Certificate description
+- `expiration` (String) Certificate expiration date, in RFC3339 format (e.g. 2022-12-31T23:59:59-05:00)
+- `file` (Attributes, Sensitive) Certificate file. Either file or url is populated. (see [below for nested schema](#nestedatt--file))
+- `folder` (String) Certificate folder path
+- `name` (String) Certificate name
+- `password` (String, Sensitive) Certificate password
+- `tags` (List of String) Certificate tags
+- `url` (Attributes) Certificate url. Either file or url is populated. (see [below for nested schema](#nestedatt--url))
+- `vault_id` (String) Vault ID
+
+<a id="nestedatt--file"></a>
+### Nested Schema for `file`
+
+Read-Only:
+
+- `content_b64` (String, Sensitive) Certificate base 64 encoded string
+- `name` (String) Certificate file name
+
+
+<a id="nestedatt--url"></a>
+### Nested Schema for `url`
+
+Read-Only:
+
+- `url` (String) Certificate url
+- `use_default_credentials` (Boolean) Use default credentials

docs/ephemeral-resources/entry_credential_api_key.md

@@ -0,0 +1,56 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "dvls_entry_credential_api_key Ephemeral Resource - terraform-provider-dvls"
+subcategory: ""
+description: |-
+  A DVLS API Key Credential Entry, fetched ephemerally so the API key never lands in Terraform state.
+---
+
+# dvls_entry_credential_api_key (Ephemeral Resource)
+
+A DVLS API Key Credential Entry, fetched ephemerally so the API key never lands in Terraform state.
+
+## Example Usage
+
+```terraform
+# Lookup by ID — the API key is fetched only during plan/apply
+# and never stored in Terraform state.
+ephemeral "dvls_entry_credential_api_key" "by_id" {
+  vault_id = "00000000-0000-0000-0000-000000000000"
+  id       = "00000000-0000-0000-0000-000000000000"
+}
+
+# Lookup by name
+ephemeral "dvls_entry_credential_api_key" "by_name" {
+  vault_id = "00000000-0000-0000-0000-000000000000"
+  name     = "foo"
+}
+
+# Lookup by name in a specific folder
+ephemeral "dvls_entry_credential_api_key" "by_name_in_folder" {
+  vault_id = "00000000-0000-0000-0000-000000000000"
+  name     = "foo"
+  folder   = "foo\\bar"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `vault_id` (String) The ID of the vault.
+
+### Optional
+
+- `folder` (String) The folder path to search in. Returns entries in the specified folder and all sub-folders.
+- `id` (String) The ID of the entry.
+- `name` (String) The name of the entry.
+
+### Read-Only
+
+- `api_id` (String) The entry credential API ID.
+- `api_key` (String, Sensitive) The entry credential API key.
+- `description` (String) The description of the entry.
+- `tags` (List of String) A list of tags added to the entry.
+- `tenant_id` (String) The entry credential tenant ID.

docs/ephemeral-resources/entry_credential_azure_service_principal.md

@@ -0,0 +1,56 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "dvls_entry_credential_azure_service_principal Ephemeral Resource - terraform-provider-dvls"
+subcategory: ""
+description: |-
+  A DVLS Azure Service Principal Credential Entry, fetched ephemerally so the client secret never lands in Terraform state.
+---
+
+# dvls_entry_credential_azure_service_principal (Ephemeral Resource)
+
+A DVLS Azure Service Principal Credential Entry, fetched ephemerally so the client secret never lands in Terraform state.
+
+## Example Usage
+
+```terraform
+# Lookup by ID — the client secret is fetched only during plan/apply
+# and never stored in Terraform state.
+ephemeral "dvls_entry_credential_azure_service_principal" "by_id" {
+  vault_id = "00000000-0000-0000-0000-000000000000"
+  id       = "00000000-0000-0000-0000-000000000000"
+}
+
+# Lookup by name
+ephemeral "dvls_entry_credential_azure_service_principal" "by_name" {
+  vault_id = "00000000-0000-0000-0000-000000000000"
+  name     = "foo"
+}
+
+# Lookup by name in a specific folder
+ephemeral "dvls_entry_credential_azure_service_principal" "by_name_in_folder" {
+  vault_id = "00000000-0000-0000-0000-000000000000"
+  name     = "foo"
+  folder   = "foo\\bar"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `vault_id` (String) The ID of the vault.
+
+### Optional
+
+- `folder` (String) The folder path to search in. Returns entries in the specified folder and all sub-folders.
+- `id` (String) The ID of the entry.
+- `name` (String) The name of the entry.
+
+### Read-Only
+
+- `client_id` (String) The entry credential client ID.
+- `client_secret` (String, Sensitive) The entry credential client secret.
+- `description` (String) The description of the entry.
+- `tags` (List of String) A list of tags added to the entry.
+- `tenant_id` (String) The entry credential tenant ID.

docs/ephemeral-resources/entry_credential_connection_string.md

@@ -0,0 +1,54 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "dvls_entry_credential_connection_string Ephemeral Resource - terraform-provider-dvls"
+subcategory: ""
+description: |-
+  A DVLS Connection String Credential Entry, fetched ephemerally so the connection string never lands in Terraform state.
+---
+
+# dvls_entry_credential_connection_string (Ephemeral Resource)
+
+A DVLS Connection String Credential Entry, fetched ephemerally so the connection string never lands in Terraform state.
+
+## Example Usage
+
+```terraform
+# Lookup by ID — the connection string is fetched only during plan/apply
+# and never stored in Terraform state.
+ephemeral "dvls_entry_credential_connection_string" "by_id" {
+  vault_id = "00000000-0000-0000-0000-000000000000"
+  id       = "00000000-0000-0000-0000-000000000000"
+}
+
+# Lookup by name
+ephemeral "dvls_entry_credential_connection_string" "by_name" {
+  vault_id = "00000000-0000-0000-0000-000000000000"
+  name     = "foo"
+}
+
+# Lookup by name in a specific folder
+ephemeral "dvls_entry_credential_connection_string" "by_name_in_folder" {
+  vault_id = "00000000-0000-0000-0000-000000000000"
+  name     = "foo"
+  folder   = "foo\\bar"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `vault_id` (String) The ID of the vault.
+
+### Optional
+
+- `folder` (String) The folder path to search in. Returns entries in the specified folder and all sub-folders.
+- `id` (String) The ID of the entry.
+- `name` (String) The name of the entry.
+
+### Read-Only
+
+- `connection_string` (String, Sensitive) The entry credential connection string.
+- `description` (String) The description of the entry.
+- `tags` (List of String) A list of tags added to the entry.

docs/ephemeral-resources/entry_credential_secret.md

@@ -0,0 +1,54 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "dvls_entry_credential_secret Ephemeral Resource - terraform-provider-dvls"
+subcategory: ""
+description: |-
+  A DVLS Secret Credential Entry, fetched ephemerally so the secret never lands in Terraform state.
+---
+
+# dvls_entry_credential_secret (Ephemeral Resource)
+
+A DVLS Secret Credential Entry, fetched ephemerally so the secret never lands in Terraform state.
+
+## Example Usage
+
+```terraform
+# Lookup by ID — the secret value is fetched only during plan/apply
+# and never stored in Terraform state.
+ephemeral "dvls_entry_credential_secret" "by_id" {
+  vault_id = "00000000-0000-0000-0000-000000000000"
+  id       = "00000000-0000-0000-0000-000000000000"
+}
+
+# Lookup by name
+ephemeral "dvls_entry_credential_secret" "by_name" {
+  vault_id = "00000000-0000-0000-0000-000000000000"
+  name     = "foo"
+}
+
+# Lookup by name in a specific folder
+ephemeral "dvls_entry_credential_secret" "by_name_in_folder" {
+  vault_id = "00000000-0000-0000-0000-000000000000"
+  name     = "foo"
+  folder   = "foo\\bar"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `vault_id` (String) The ID of the vault.
+
+### Optional
+
+- `folder` (String) The folder path to search in. Returns entries in the specified folder and all sub-folders.
+- `id` (String) The ID of the entry.
+- `name` (String) The name of the entry.
+
+### Read-Only
+
+- `description` (String) The description of the entry.
+- `secret` (String, Sensitive) The entry credential secret.
+- `tags` (List of String) A list of tags added to the entry.

docs/ephemeral-resources/entry_credential_ssh_key.md

@@ -0,0 +1,58 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "dvls_entry_credential_ssh_key Ephemeral Resource - terraform-provider-dvls"
+subcategory: ""
+description: |-
+  A DVLS SSH Key Credential Entry, fetched ephemerally so the private key never lands in Terraform state.
+---
+
+# dvls_entry_credential_ssh_key (Ephemeral Resource)
+
+A DVLS SSH Key Credential Entry, fetched ephemerally so the private key never lands in Terraform state.
+
+## Example Usage
+
+```terraform
+# Lookup by ID — the private key is fetched only during plan/apply
+# and never stored in Terraform state.
+ephemeral "dvls_entry_credential_ssh_key" "by_id" {
+  vault_id = "00000000-0000-0000-0000-000000000000"
+  id       = "00000000-0000-0000-0000-000000000000"
+}
+
+# Lookup by name
+ephemeral "dvls_entry_credential_ssh_key" "by_name" {
+  vault_id = "00000000-0000-0000-0000-000000000000"
+  name     = "foo"
+}
+
+# Lookup by name in a specific folder
+ephemeral "dvls_entry_credential_ssh_key" "by_name_in_folder" {
+  vault_id = "00000000-0000-0000-0000-000000000000"
+  name     = "foo"
+  folder   = "foo\\bar"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `vault_id` (String) The ID of the vault.
+
+### Optional
+
+- `folder` (String) The folder path to search in. Returns entries in the specified folder and all sub-folders.
+- `id` (String) The ID of the entry.
+- `name` (String) The name of the entry.
+
+### Read-Only
+
+- `description` (String) The description of the entry.
+- `passphrase` (String, Sensitive) The entry credential passphrase.
+- `password` (String, Sensitive) The entry credential password.
+- `private_key_data` (String, Sensitive) The entry credential private key data.
+- `public_key` (String) The entry credential public key data.
+- `tags` (List of String) A list of tags added to the entry.
+- `username` (String) The entry credential username.