|
| 1 | +package secretmanager |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "encoding/base64" |
| 6 | + "fmt" |
| 7 | + |
| 8 | + "github.com/hashicorp/terraform-plugin-framework/ephemeral" |
| 9 | + "github.com/hashicorp/terraform-plugin-framework/ephemeral/schema" |
| 10 | + "github.com/hashicorp/terraform-plugin-framework/types" |
| 11 | + transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport" |
| 12 | +) |
| 13 | + |
| 14 | +var _ ephemeral.EphemeralResource = &googleEphemeralSecretManagerSecretVersion{} |
| 15 | + |
| 16 | +func GoogleEphemeralSecretManagerSecretVersion() ephemeral.EphemeralResource { |
| 17 | + return &googleEphemeralSecretManagerSecretVersion{} |
| 18 | +} |
| 19 | + |
| 20 | +type googleEphemeralSecretManagerSecretVersion struct { |
| 21 | + providerConfig *transport_tpg.Config |
| 22 | +} |
| 23 | + |
| 24 | +func (p *googleEphemeralSecretManagerSecretVersion) Metadata(ctx context.Context, req ephemeral.MetadataRequest, resp *ephemeral.MetadataResponse) { |
| 25 | + resp.TypeName = req.ProviderTypeName + "_secret_manager_secret_version" |
| 26 | +} |
| 27 | + |
| 28 | +type ephemeralSecretManagerSecretVersionModel struct { |
| 29 | + Project types.String `tfsdk:"project"` |
| 30 | + Secret types.String `tfsdk:"secret"` |
| 31 | + Version types.String `tfsdk:"version"` |
| 32 | + IsSecretDataBase64 types.Bool `tfsdk:"is_secret_data_base64"` |
| 33 | + SecretData types.String `tfsdk:"secret_data"` |
| 34 | + Name types.String `tfsdk:"name"` |
| 35 | + CreateTime types.String `tfsdk:"create_time"` |
| 36 | + DestroyTime types.String `tfsdk:"destroy_time"` |
| 37 | + Enabled types.Bool `tfsdk:"enabled"` |
| 38 | +} |
| 39 | + |
| 40 | +func (p *googleEphemeralSecretManagerSecretVersion) Schema(ctx context.Context, req ephemeral.SchemaRequest, resp *ephemeral.SchemaResponse) { |
| 41 | + resp.Schema.Description = "This ephemeral resource provides access to a Google Secret Manager secret version." |
| 42 | + resp.Schema.MarkdownDescription = "This ephemeral resource provides access to a Google Secret Manager secret version." |
| 43 | + |
| 44 | + resp.Schema = schema.Schema{ |
| 45 | + Attributes: map[string]schema.Attribute{ |
| 46 | + // Arguments |
| 47 | + "project": schema.StringAttribute{ |
| 48 | + Description: "The project to get the secret version for. If it is not provided, the provider project is used.", |
| 49 | + Optional: true, |
| 50 | + Computed: true, |
| 51 | + }, |
| 52 | + "secret": schema.StringAttribute{ |
| 53 | + Description: "The secret to get the secret version for.", |
| 54 | + Required: true, |
| 55 | + }, |
| 56 | + "version": schema.StringAttribute{ |
| 57 | + Description: "The version of the secret to get. If it is not provided, the latest version is retrieved.", |
| 58 | + Optional: true, |
| 59 | + }, |
| 60 | + "is_secret_data_base64": schema.BoolAttribute{ |
| 61 | + Description: "If true, the secret data returned will not get base64 decoded. Defaults to false.", |
| 62 | + Optional: true, |
| 63 | + }, |
| 64 | + // Attributes |
| 65 | + "secret_data": schema.StringAttribute{ |
| 66 | + Description: "The secret data. No larger than 64KiB.", |
| 67 | + Computed: true, |
| 68 | + Sensitive: true, |
| 69 | + }, |
| 70 | + "name": schema.StringAttribute{ |
| 71 | + Description: "The resource name of the SecretVersion. Format: `projects/{{project}}/secrets/{{secret_id}}/versions/{{version}}`.", |
| 72 | + Computed: true, |
| 73 | + }, |
| 74 | + "create_time": schema.StringAttribute{ |
| 75 | + Description: "The time at which the Secret was created.", |
| 76 | + Computed: true, |
| 77 | + }, |
| 78 | + "destroy_time": schema.StringAttribute{ |
| 79 | + Description: "The time at which the Secret was destroyed. Only present if state is DESTROYED.", |
| 80 | + Computed: true, |
| 81 | + }, |
| 82 | + "enabled": schema.BoolAttribute{ |
| 83 | + Description: "True if the current state of the SecretVersion is enabled.", |
| 84 | + Computed: true, |
| 85 | + }, |
| 86 | + }, |
| 87 | + } |
| 88 | +} |
| 89 | + |
| 90 | +func (p *googleEphemeralSecretManagerSecretVersion) Configure(ctx context.Context, req ephemeral.ConfigureRequest, resp *ephemeral.ConfigureResponse) { |
| 91 | + // Prevent panic if the provider has not been configured. |
| 92 | + if req.ProviderData == nil { |
| 93 | + return |
| 94 | + } |
| 95 | + |
| 96 | + pd, ok := req.ProviderData.(*transport_tpg.Config) |
| 97 | + if !ok { |
| 98 | + resp.Diagnostics.AddError( |
| 99 | + "Unexpected Data Source Configure Type", |
| 100 | + fmt.Sprintf("Expected *transport_tpg.Config, got: %T. Please report this issue to the provider developers.", req.ProviderData), |
| 101 | + ) |
| 102 | + return |
| 103 | + } |
| 104 | + |
| 105 | + // Required for accessing userAgent and passing as an argument into a util function |
| 106 | + p.providerConfig = pd |
| 107 | +} |
| 108 | + |
| 109 | +func (p *googleEphemeralSecretManagerSecretVersion) Open(ctx context.Context, req ephemeral.OpenRequest, resp *ephemeral.OpenResponse) { |
| 110 | + var data ephemeralSecretManagerSecretVersionModel |
| 111 | + |
| 112 | + resp.Diagnostics.Append(req.Config.Get(ctx, &data)...) |
| 113 | + if resp.Diagnostics.HasError() { |
| 114 | + return |
| 115 | + } |
| 116 | + |
| 117 | + config := p.providerConfig |
| 118 | + userAgent := p.providerConfig.UserAgent |
| 119 | + |
| 120 | + secret := data.Secret.ValueString() |
| 121 | + project := data.Project.ValueString() |
| 122 | + version := data.Version.ValueString() |
| 123 | + |
| 124 | + if project == "" { |
| 125 | + project = config.Project |
| 126 | + } |
| 127 | + |
| 128 | + var url string |
| 129 | + if version != "" { |
| 130 | + url = fmt.Sprintf("%s%s/versions/%s", config.SecretManagerBasePath, secret, version) |
| 131 | + } else { |
| 132 | + url = fmt.Sprintf("%s%s/versions/latest", config.SecretManagerBasePath, secret) |
| 133 | + } |
| 134 | + |
| 135 | + versionResp, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{ |
| 136 | + Config: config, |
| 137 | + Method: "GET", |
| 138 | + Project: project, |
| 139 | + RawURL: url, |
| 140 | + UserAgent: userAgent, |
| 141 | + }) |
| 142 | + if err != nil { |
| 143 | + resp.Diagnostics.AddError("Error retrieving secret version", err.Error()) |
| 144 | + return |
| 145 | + } |
| 146 | + |
| 147 | + accessURL := fmt.Sprintf("%s%s:access", config.SecretManagerBasePath, versionResp["name"]) |
| 148 | + accessResp, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{ |
| 149 | + Config: config, |
| 150 | + Method: "GET", |
| 151 | + Project: project, |
| 152 | + RawURL: accessURL, |
| 153 | + UserAgent: userAgent, |
| 154 | + }) |
| 155 | + if err != nil { |
| 156 | + resp.Diagnostics.AddError("Error accessing secret data", err.Error()) |
| 157 | + return |
| 158 | + } |
| 159 | + |
| 160 | + // This check seems counterintuitive, but read docs on the `google_secret_manager_secret_version` resource. |
| 161 | + // It states: "If set to 'true', the secret data is expected to be base64-encoded string and would be sent as is." |
| 162 | + payload := accessResp["payload"].(map[string]interface{}) |
| 163 | + payloadData := payload["data"].(string) |
| 164 | + if !data.IsSecretDataBase64.ValueBool() { |
| 165 | + decoded, err := base64.StdEncoding.DecodeString(payload["data"].(string)) |
| 166 | + if err != nil { |
| 167 | + resp.Diagnostics.AddError("Error decoding secret data", err.Error()) |
| 168 | + return |
| 169 | + } |
| 170 | + payloadData = string(decoded) |
| 171 | + } |
| 172 | + |
| 173 | + data.SecretData = types.StringValue(payloadData) |
| 174 | + data.Name = types.StringValue(versionResp["name"].(string)) |
| 175 | + data.CreateTime = types.StringValue(versionResp["createTime"].(string)) |
| 176 | + data.Project = types.StringValue(project) |
| 177 | + data.Enabled = types.BoolValue(true) |
| 178 | + |
| 179 | + if destroyTime, ok := versionResp["destroyTime"]; ok { |
| 180 | + data.DestroyTime = types.StringValue(destroyTime.(string)) |
| 181 | + } |
| 182 | + |
| 183 | + resp.Diagnostics.Append(resp.Result.Set(ctx, data)...) |
| 184 | +} |
0 commit comments