ephemeral resource: add google_compute_ssl_certificate and google_compute_region_ssl_certificate support

[avinashpancham]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Description

We would like to use the new feature "ephemeral resources" for the resources google_compute_ssl_certificate and google_compute_region_ssl_certificate to prevent storing sensitive values for the attributes certificate and private key in the raw state as plain text

The Terraform docs for this resource state:

All arguments including the following potentially sensitive values will be stored in the raw state as plain text: certificate, private_key. [Read more about sensitive data in state](https://www.terraform.io/language/state/sensitive-data).

I would be open to help create this resource, I would need some guidance though.

New or Affected Resource(s)

• google_compute_ssl_certificate
• google_compute_region_ssl_certificate

Potential Terraform Configuration

ephemeral "google_compute_ssl_certificate" "this" {
  name            = "foo"
  private_key = "pvt-key-string"
  certificate    = "cert-string"
}

ephemeral "google_compute_regon_ssl_certificate" "this" {
  name            = "foo"
  region          = "europe-west4"
  private_key = "pvt-key-string"
  certificate    = "cert-string"
}

References

https://www.hashicorp.com/blog/terraform-1-10-improves-handling-secrets-in-state-with-ephemeral-values
https://developer.hashicorp.com/terraform/language/resources/ephemeral

[rileykarson]

Note: Forwarding exempt until we add docs for self-service contributors to add ephemeral resource support

[avinashpancham]

What are the timlines to allow contributions?

[avinashpancham]

@rileykarson do you know when this would be open for me to contribute?

[rileykarson]

@BBBmau can you assist here?

There's probably not a blocker to contribute if you can figure it out- we just don't have docs targeted at service team members @ Google yet to do so.