Add Auth0 Action Secret Resource

[bshore-bf]

Checklist

• I agree to the terms within the Auth0 Code of Conduct.

Describe the problem you'd like to have solved

To keep our Auth0 Action Secret values secure, we do not want the values to be stored in our Terraform code or in the Terraform state files. One way to accomplish this is to use the lifecycle Meta-Argument with ignore_changes on the attribute and then set/manage the secret value outside the scope of Terraform. The issue is that it cannot be used dynamically or on nested attributes.

dynamic "secrets" {
  for_each = var.secrets # ex: ["SOME_CLIENT_SECRET", "SOME_API_KEY"]

  content {
    name = secrets.value
    value = "placeholder"
  }
}

lifecycle {
  ignore_changes = [secrets] # ignores ALL secrets (create/update/delete)
  # ignore_changes = [ secrets.value ] # not possible
  # ignore_changes = [ for s in var.secrets : secrets[s].value ] # not possible
}

Describe the ideal solution

A new resource auth0_action_secret that manages a single instance of a secret.

resource "auth0_action" "example" {
  name = "example"
  /*
    ...etc
  */
}

resource "auth0_action_secret" "secrets" {
  for_each = var.secrets # ex: ["SOME_CLIENT_SECRET", "SOME_API_KEY"]

  action_id = auth0_action.example.id
  name      = each.value
  value     = "placeholder"

  lifecycle {
    ignore_changes = [value]
  }
}

Alternatives and current workarounds

No current workaround or alternative that I am aware of. At the moment our auth0_action secrets are 100% ignored and manually managed via the Auth0 Dashboard.

Additional context

No response

[duedares-rvj]

@bshore-bf Hello! 👋

Thank you so much for opening this issue with the thoughtful suggestion.
I would explore the possibilities of this feature and revert back soon.

Thank you for the patience.

[bshore-bf]

@duedares-rvj Hello!

Thank you for the quick response and I'm happy you are looking into it!

[duedares-rvj]

Hi @bshore-bf 👋

Thanks again for taking the time to share this. We really appreciate the thought you’ve put into outlining the problem and proposing a potential solution.

This is definitely an insightful suggestion, and we agree that there’s value in being able to manage secrets in a more granular and secure way. That said, we’ll need to take a bit more time to fully explore the implications of introducing a dedicated auth0_action_secret resource. One concern is that it will introduce a breaking change for existing users, and if we were to pursue this, it would likely need to be part of a major version release — with appropriate guidance and communication.

We’ve had similar experiences in the past (like when we separated scopes from auth0_resource_server into their own resource), and even with a solid migration guide, it caused some disruption and confusion for users (example).

For now, I’m going to move this to the discussion board so we can gather more feedback from the community. If there’s enough interest, we’d be happy to revisit and explore it further.

Thanks again for raising this, your input truly helps shape the direction of the provider in a meaningful way.
Regards.