Add support for Customer Key Version and Encrypted Data Keys by helenjw · Pull Request #1203 · hashicorp/go-tfe

helenjw · 2025-08-27T19:29:44Z

Description

Add support for HYOK customer key versions and HYOK encrypted data keys.

Supported operations for HYOKCustomerKeyVersions:

List
Read
Revoke
Delete

Supported operations for HYOKEncryptedDataKey:

Read

External links

Output from tests

envchain local-go-tfe go test -run TestHYOKEncryptedDataKeyRead -v           16:46:44   29ms
=== RUN   TestHYOKEncryptedDataKeyRead
=== RUN   TestHYOKEncryptedDataKeyRead/read_an_existing_encrypted_data_key
--- PASS: TestHYOKEncryptedDataKeyRead (0.42s)
    --- PASS: TestHYOKEncryptedDataKeyRead/read_an_existing_encrypted_data_key (0.17s)
PASS
ok  	github.com/hashicorp/go-tfe	0.983s

envchain local-go-tfe go test -run TestHYOKCustomerKeyVersions -v          16:46:55   3.019s
=== RUN   TestHYOKCustomerKeyVersionsList
=== RUN   TestHYOKCustomerKeyVersionsList/with_no_list_options
--- PASS: TestHYOKCustomerKeyVersionsList (7.76s)
    --- PASS: TestHYOKCustomerKeyVersionsList/with_no_list_options (0.10s)
=== RUN   TestHYOKCustomerKeyVersionsRead
=== RUN   TestHYOKCustomerKeyVersionsRead/read_an_existing_key_version
--- PASS: TestHYOKCustomerKeyVersionsRead (0.34s)
    --- PASS: TestHYOKCustomerKeyVersionsRead/read_an_existing_key_version (0.12s)
PASS
ok  	github.com/hashicorp/go-tfe	8.630s

Rollback Plan

Changes to Security Controls

hashicorp-cla-app · 2025-08-27T19:30:00Z

All committers have signed the CLA.

hashicorp-cla-app · 2025-08-27T19:30:00Z

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

1 out of 2 committers have signed the CLA.

iuri-slywitch-hashicorp
helenjw

_{Have you signed the CLA already but the status is still pending? Recheck it.}

helenjw · 2025-08-27T20:49:44Z

aws_oidc_configuration.go

+// AWSOIDCConfigurations describes all the AWS OIDC configuration related methods that the HCP Terraform API supports.
+// HCP Terraform API docs:
+// https://developer.hashicorp.com/terraform/cloud-docs/api-docs/hold-your-own-key/oidc-configurations/aws


Realized these were missing from the PR for OIDC and HYOK configs 😢

hyok_customer_key_version.go

iuri-slywitch-hashicorp · 2025-08-27T21:18:13Z

hyok_encrypted_data_key.go

+// Read a HYOK encrypted data key by its ID.
+func (h hyokEncryptedDataKeys) Read(ctx context.Context, hyokEncryptedDataKeyID string) (*HYOKEncryptedDataKey, error) {
+	if !validStringID(&hyokEncryptedDataKeyID) {
+		return nil, ErrInvalidHYOK


should we change ErrInvalidHYOK to something like ErrInvalidHYOKEncryptedDataKeyID?

This was also addressed in 519cd19

iuri-slywitch-hashicorp · 2025-08-27T21:21:34Z

hyok_customer_key_version_integration_test.go

I wonder if we should have test cases for Revoke and Delete.

That's tough, because we cant create the key version in tests. So we would need the user to manually input the key version ID which they want to revoke, and the test could only ever run once without changing the ID....that could work, but IMHO it probably isnt worth it

hyok_customer_key_version.go

JarrettSpiker · 2025-08-28T13:10:05Z

hyok_customer_key_version_integration_test.go

That's tough, because we cant create the key version in tests. So we would need the user to manually input the key version ID which they want to revoke, and the test could only ever run once without changing the ID....that could work, but IMHO it probably isnt worth it

Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com>

iuri-slywitch-hashicorp

LGTM

github-actions · 2025-08-28T19:34:15Z

Reminder to the contributor that merged this PR: if your changes have added important functionality or fixed a relevant bug, open a follow-up PR to update CHANGELOG.md with a note on your changes.

Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com>

* initial attribute changes, wip * Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Update workspace.go Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Add support for Customer Key Version and Encrypted Data Keys (#1203) Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * Updating attributes. * Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Add support for Customer Key Version and Encrypted Data Keys (#1203) Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * Updating agent_pool. Added test case. * Updated agent pool integration test file. * Revert commented section. * Updating organization. WIP organization_integration_test. * Updated organization integration test. * Updating attributes. Updating test cases. * Added workspace integration test cases * Updated test cases. * Updated state_version. Updated Read test cases. * Updated hyok tests. Added environment variables. * Updated errors.go * WIP StateVersion * Updated skipHYOKIntegrationTests if-statement. * Added hyok-testing.sh to scripts folder. Finished state_version testing and new functions. * Updated uploading test. * Added comments to UploadSanitizedState. * Updated hyok test cases. * Updating state_version_mocks.go. --------- Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> Co-authored-by: Helen Jiang <50344290+helenjw@users.noreply.github.com>

Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com>

* initial attribute changes, wip * Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Update workspace.go Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Add support for Customer Key Version and Encrypted Data Keys (#1203) Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * Updating attributes. * Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Add support for Customer Key Version and Encrypted Data Keys (#1203) Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * Updating agent_pool. Added test case. * Updated agent pool integration test file. * Revert commented section. * Updating organization. WIP organization_integration_test. * Updated organization integration test. * Updating attributes. Updating test cases. * Added workspace integration test cases * Updated test cases. * Updated state_version. Updated Read test cases. * Updated hyok tests. Added environment variables. * Updated errors.go * WIP StateVersion * Updated skipHYOKIntegrationTests if-statement. * Added hyok-testing.sh to scripts folder. Finished state_version testing and new functions. * Updated uploading test. * Added comments to UploadSanitizedState. * Updated hyok test cases. * Updating state_version_mocks.go. --------- Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> Co-authored-by: Helen Jiang <50344290+helenjw@users.noreply.github.com>

* Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Add support for Customer Key Version and Encrypted Data Keys (#1203) Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * [TF-27661] Add support for HYOK related attributes (#1192) * initial attribute changes, wip * Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Update workspace.go Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Add support for Customer Key Version and Encrypted Data Keys (#1203) Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * Updating attributes. * Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Add support for Customer Key Version and Encrypted Data Keys (#1203) Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * Updating agent_pool. Added test case. * Updated agent pool integration test file. * Revert commented section. * Updating organization. WIP organization_integration_test. * Updated organization integration test. * Updating attributes. Updating test cases. * Added workspace integration test cases * Updated test cases. * Updated state_version. Updated Read test cases. * Updated hyok tests. Added environment variables. * Updated errors.go * WIP StateVersion * Updated skipHYOKIntegrationTests if-statement. * Added hyok-testing.sh to scripts folder. Finished state_version testing and new functions. * Updated uploading test. * Added comments to UploadSanitizedState. * Updated hyok test cases. * Updating state_version_mocks.go. --------- Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> Co-authored-by: Helen Jiang <50344290+helenjw@users.noreply.github.com> * Update CHANGELOG.md * Remove UpdatedAt and RevokedAt fields from hyok_customer_key_version * added workplaces secured * renamed workplaces to workspaces... oops * Update agent_pool.go Co-authored-by: Sebastian Rivera <sebastian.rivera@hashicorp.com> * Moved valid function in aws_oidc_configuration.go * Removing "omitempty" from HYOKEncryptedDataKey relationships * Changed from "string" to "*string" in state_version.go and added url.PathEscape in request calls for hyok stuff. * Moving HYOK organization validation to helper_test.go * Updating mock file. --------- Co-authored-by: iuri-slywitch-hashicorp <170475063+iuri-slywitch-hashicorp@users.noreply.github.com> Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> Co-authored-by: Dominic Retli <dominic.retli@hashicorp.com> Co-authored-by: Sebastian Rivera <sebastian.rivera@hashicorp.com> Co-authored-by: Iuri Slywitch <iuri.slywitch@hashicorp.com>

helenjw added 6 commits August 27, 2025 10:46

Add for hyok_customer_key_version.go, with questions

bf04adf

update interface definition

8f9f3dc

Hyok -> HYOK

f8dad00

Add key version relationship

8b1d2d4

hyok_customer_key_version_integration_test.go

8d53bf4

implement hyok_encrypted_data_key.go

5a25db4

helenjw changed the base branch from main to feature/hyok August 27, 2025 19:30

helenjw added 2 commits August 27, 2025 15:34

remove KeyVersions field from HYOKConfigurationsCreateOptions struct

c4a90bc

finish up tests

60d9f25

helenjw changed the title ~~Add Support for Customer Key Version and Encrypted Data Keys~~ Add support for Customer Key Version and Encrypted Data Keys Aug 27, 2025

helenjw added the no-changelog-needed check changelog entry github workflow label Aug 27, 2025

Add API docs

6c77e44

helenjw commented Aug 27, 2025

View reviewed changes

helenjw requested a review from a team August 27, 2025 20:50

helenjw marked this pull request as ready for review August 27, 2025 20:50

helenjw requested a review from a team as a code owner August 27, 2025 20:50

iuri-slywitch-hashicorp reviewed Aug 27, 2025

View reviewed changes

hyok_customer_key_version.go Show resolved Hide resolved

iuri-slywitch-hashicorp reviewed Aug 27, 2025

View reviewed changes

JarrettSpiker reviewed Aug 28, 2025

View reviewed changes

helenjw and others added 3 commits August 28, 2025 09:23

Update hyok_customer_key_version.go comment

c080181

Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com>

Change Refresh from string to bool

19edb0f

Use ErrInvalidHYOKCustomerKeyVersion and ErrInvalidHYOKEncryptedDataKey

519cd19

helenjw requested a review from JarrettSpiker August 28, 2025 13:59

JarrettSpiker approved these changes Aug 28, 2025

View reviewed changes

iuri-slywitch-hashicorp approved these changes Aug 28, 2025

View reviewed changes

helenjw mentioned this pull request Aug 28, 2025

Hold Your Own Key Support #1201

Merged

Maed223 approved these changes Aug 28, 2025

View reviewed changes

helenjw merged commit b60638c into feature/hyok Aug 28, 2025
8 checks passed

helenjw deleted the helenjw/TF-27660/hyok-customer-key-versions branch August 28, 2025 19:34

helenjw added a commit that referenced this pull request Aug 29, 2025

Add support for Customer Key Version and Encrypted Data Keys (#1203)

c006283

Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com>

iuri-slywitch-hashicorp pushed a commit that referenced this pull request Sep 12, 2025

Add support for Customer Key Version and Encrypted Data Keys (#1203)

eaf7215

Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com>

helenjw added a commit that referenced this pull request Sep 15, 2025

Add support for Customer Key Version and Encrypted Data Keys (#1203)

8b0c086

Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for Customer Key Version and Encrypted Data Keys#1203

Add support for Customer Key Version and Encrypted Data Keys#1203
helenjw merged 12 commits intofeature/hyokfrom
helenjw/TF-27660/hyok-customer-key-versions

helenjw commented Aug 27, 2025 •

edited

Loading

Uh oh!

hashicorp-cla-app bot commented Aug 27, 2025 •

edited

Loading

Uh oh!

hashicorp-cla-app bot commented Aug 27, 2025 •

edited by helenjw

Loading

Uh oh!

helenjw Aug 27, 2025

Uh oh!

Uh oh!

iuri-slywitch-hashicorp Aug 27, 2025

Uh oh!

helenjw Aug 28, 2025

Uh oh!

iuri-slywitch-hashicorp Aug 27, 2025

Uh oh!

JarrettSpiker Aug 28, 2025

Uh oh!

Uh oh!

Uh oh!

JarrettSpiker Aug 28, 2025

Uh oh!

iuri-slywitch-hashicorp left a comment

Uh oh!

Uh oh!

github-actions bot commented Aug 28, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

helenjw commented Aug 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

External links

Output from tests

Rollback Plan

Changes to Security Controls

Uh oh!

hashicorp-cla-app bot commented Aug 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hashicorp-cla-app bot commented Aug 27, 2025 • edited by helenjw Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

helenjw Aug 27, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

iuri-slywitch-hashicorp Aug 27, 2025

Choose a reason for hiding this comment

Uh oh!

helenjw Aug 28, 2025

Choose a reason for hiding this comment

Uh oh!

iuri-slywitch-hashicorp Aug 27, 2025

Choose a reason for hiding this comment

Uh oh!

JarrettSpiker Aug 28, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

JarrettSpiker Aug 28, 2025

Choose a reason for hiding this comment

Uh oh!

iuri-slywitch-hashicorp left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Aug 28, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

helenjw commented Aug 27, 2025 •

edited

Loading

hashicorp-cla-app bot commented Aug 27, 2025 •

edited

Loading

hashicorp-cla-app bot commented Aug 27, 2025 •

edited by helenjw

Loading