add ephemeral password option

[haydn-j-evans]

This PR introduces the ability to use a write_only password, which does not save the password in the state.

See https://developer.hashicorp.com/terraform/language/resources/ephemeral/write-only for more infomation.

We have two new fields for this feature

password_wo - conflicts with password, when set this will be used to update the password of the role during apply, and will clear the password state.

password_wo_version - an optional field that controls when the role password is updated when password_wo is set. When unset, the role password is updated on every apply regardless on the stored value.

Will close issues #532 & #519

[rogiervanstraten]

Yes please! @cyrilgdn

[hylje]

I've given it a go, but updating password_wo_version will error out if you have given any grants to the role because it forces replacing the role instead of updating it in place. Postgres will refuse to drop the role because it has dependent objects (the grants) and re-creating the role fails because the original still exists.

You can work around this by giving the role name a random salt, but the old roles will stay around in the database Terraform will actually delete the grants before deleting the role in this case, so it'll stay tidy.

[haydn-j-evans]

@hylje thanks for checking it, I can't actually remember now why I added ForceNew: true to the wo attribute (I think maybe i was experimenting on the best way to clear the old password state, I think we can remove this though.

Edit. Removed it without issues, so you can check it again :)

[haydn-j-evans]

The job was not started because recent account payments have failed or your spending limit needs to be increased. Please check the 'Billing & plans' section in your settings

jobs are failing due to some account payment/info issues here:

Works fine running them in my account btw

https://github.com/haydn-j-evans/terraform-provider-postgresql/actions/runs/16862855508
https://github.com/haydn-j-evans/terraform-provider-postgresql/actions/runs/16862855507

[Copilot]

Pull Request Overview

This PR introduces write-only password management for PostgreSQL roles, allowing passwords to be managed without storing them in the Terraform state file. The feature improves security by preventing password exposure in state files while maintaining full password management capabilities through version-controlled updates.

Key Changes:

• Added password_wo and password_wo_version attributes for write-only password management
• Enhanced role creation/update logic to handle write-only passwords with version-based change detection
• Updated documentation with comprehensive write-only password usage examples

Reviewed Changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

File	Description
postgresql/resource_postgresql_role.go	Core implementation of write-only password functionality with version-based updates
postgresql/resource_postgresql_role_test.go	Comprehensive test coverage for write-only password scenarios including versioning
website/docs/r/postgresql_role.html.markdown	Documentation updates with usage examples and security guidance
go.mod	Updated Go version and dependency versions

Comments suppressed due to low confidence (1)

postgresql/resource_postgresql_role.go:1019

• Removing the debug log statement log.Printf("[DEBUG] revoking role %s from %s", grantedRole, role) reduces debugging capability. This change appears unrelated to the write-only password feature and should be kept or moved to a separate commit.

		if _, err := txn.Exec(query); err != nil {

[cyrilgdn]

Should we use an integer like in Terraform example ?

[haydn-j-evans]

functionally it doesn't matter, my reasoning was that it allows a user to use things like githash variables as a trigger.

example: for my rds databases I update the master password on every pipeline run, I would prefer to use my githash variable I inject from the pipeline this, but as its not an integer I have to do this instead

resource "time_static" "trigger" {
  triggers = {
    # The timestamp() function is re-evaluated on every run,
    # ensuring this trigger value always changes.
    always_run = timestamp()
  }
}

master_password_wo_version = time_static.trigger.unix

Though there is also value in keeping the pattern the same as other projects that use a wo_version

Up to you, its your project :)

[haydn-j-evans]

@cyrilgdn I'm leaning towards changing it to a integer to keep it in line with other resources doing the same thing. Happy with that?

[cyrilgdn]

@haydn-j-evans No it's ok, it's a good reasoning for me 👍

[cyrilgdn]

@haydn-j-evans This has been released in https://github.com/cyrilgdn/terraform-provider-postgresql/releases/tag/v1.26.0

[rogiervanstraten]

Really appreciate the work on this one 🙏🏽