Open
Description
Community Note
- Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
- Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
- If you are interested in working on this issue or have submitted a pull request, please leave a comment.
- If an issue is assigned to a user, that user is claiming responsibility for the issue.
- Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.
Description
We would like to use the new feature "ephemeral resources" for the resource google_compute_region_backend_service to prevent storing sensitive values for the attributes iap.oauth2_client_secret and iap.oauth2_client_secret_sha256 in the raw state as plain text
The Terraform docs for this resource state:
All arguments including the following potentially sensitive values will be stored in the raw state as plain text: iap.oauth2_client_secret, iap.oauth2_client_secret_sha256. [Read more about sensitive data in state](https://www.terraform.io/language/state/sensitive-data).
I would be open to help create this resource, I would need some guidance though.
New or Affected Resource(s)
- google_compute_region_backend_service
Potential Terraform Configuration
ephemeral "google_compute_region_backend_service" "this" {
name = "tf-test-region-service-external"
region = "us-central1"
protocol = "HTTP"
load_balancing_scheme = "EXTERNAL"
iap {
enabled = true
oauth2_client_id = "abc"
oauth2_client_secret = "xyz" (either oauth2_client_secret or oauth2_client_secret_sha256)
oauth2_client_secret_sha256 = "xyz" (either oauth2_client_secret or oauth2_client_secret_sha256)
}
}References
https://www.hashicorp.com/blog/terraform-1-10-improves-handling-secrets-in-state-with-ephemeral-values
https://developer.hashicorp.com/terraform/language/resources/ephemeral