[TF-28674] Add HYOK data sources for HYOKCustomerKeyVersion and HYOKEncryptedDataKey #1842

dominic-retli-hashi · 2025-09-15T18:13:10Z

Description

added data source for HYOKCustomerKeyVersion
added data source for HYOKEncryptedDataKey
added test coverage for the data sources (the tests rely on the presence of env variables to speicify the IDs of the records in the database).

TODO: Update the website docs for new datasources

Remember to:

Update the Change Log
Update the Documentation

Testing plan

Using a version of Hold Your Own Key Support go-tfe#1201 and using an organization with access to HYOK
Use a terraform configuration with outputs to read HYOK data source via terraform plan and terraform apply.

data "tfe_hyok_customer_key_version" "tfe_hyok_customer_key_version1" {
  id = "keyv-<your-id>"
}

output "customer_key_version" {
  value = data.tfe_hyok_customer_key_version.tfe_hyok_customer_key_version1
}

data "tfe_hyok_encrypted_data_key" "tfe_hyok_encrypted_data_key1" {
  id = "dek-<your-id>"
}

output "tfe_hyok_encrypted_data_key" {
  value = data.tfe_hyok_encrypted_data_key.tfe_hyok_encrypted_data_key1
}

Example Output of a Terraform Run:

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

customer_key_version = {
  "created_at" = "2025-09-09T17:27:14Z"
  "error" = ""
  "id" = "keyv-BWZTzt2J75DsdwH8"
  "key_version" = "10"
  "status" = "available"
  "workspaces_secured" = 2
}
tfe_hyok_encrypted_data_key = {
  "created_at" = "2025-09-09T17:27:14Z"
  "customer_key_name" = "tf-rocket-hyok-oasis"
  "encrypted_dek" = "dmF1bHQ6djEwOjdFb3gzNERXQ05zNGVNelNSb09waWp3dGE4SmlNa0JjWFRsQ25KbXlRNlZWRGpCbnFtOFBvbGkvb1ZGTkQ3UVFybDNoNzBrT2hScnlHUlZS"
  "id" = "dek-wuLiejfGtNLLuiH9"
}

External links

Include any links here that might be helpful for people reviewing your PR. If there are none, feel free to delete this section.

Output from acceptance tests

Please run applicable acceptance tests locally and include the output here. See testing.md to learn how to run acceptance tests.

If you are an external contributor, your contribution(s) will first be reviewed before running them against the project's CI pipeline.

TESTARGS="-run TestAccTFEHYOKCustomerKeyVersionDataSource" make testacc
TF_ACC=1 TF_LOG_SDK_PROTO=OFF go test $(go list ./... |grep -v 'vendor') -v -run TestAccTFEHYOKCustomerKeyVersionDataSource -timeout 15m
?       github.com/hashicorp/terraform-provider-tfe     [no test files]
testing: warning: no tests to run
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/client     0.187s [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/logging    0.294s [no tests to run]
=== RUN   TestAccTFEHYOKCustomerKeyVersionDataSource_basic
--- PASS: TestAccTFEHYOKCustomerKeyVersionDataSource_basic (0.93s)
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/provider   1.266s
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/helpers   [no test files]
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/planmodifiers     [no test files]
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/validators        [no test files]
?       github.com/hashicorp/terraform-provider-tfe/version     [no test files]

TESTARGS="-run TestAccTFEHYOKEncryptedDataKeyDataSource" make testacc
TF_ACC=1 TF_LOG_SDK_PROTO=OFF go test $(go list ./... |grep -v 'vendor') -v -run TestAccTFEHYOKEncryptedDataKeyDataSource -timeout 15m
?       github.com/hashicorp/terraform-provider-tfe     [no test files]
testing: warning: no tests to run
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/client     0.299s [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/logging    0.150s [no tests to run]
=== RUN   TestAccTFEHYOKEncryptedDataKeyDataSource_basic
--- PASS: TestAccTFEHYOKEncryptedDataKeyDataSource_basic (1.12s)
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/provider   1.439s
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/helpers   [no test files]
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/planmodifiers     [no test files]
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/validators        [no test files]
?       github.com/hashicorp/terraform-provider-tfe/version     [no test files]

Rollback Plan

Changes to Security Controls

…ersion, with some baseline tests that pass for me locally but need to be genericised

…n testing.md

helenjw

I tested the data sources and they're working for me! Just a few nits and something I gotta do on the go-tfe end

internal/provider/data_source_hyok_customer_key_version.go

internal/provider/data_source_hyok_encrypted_data_key.go

internal/provider/data_source_hyok_customer_key_version.go

…/hyok-data-objects

internal/provider/data_source_hyok_encrypted_data_key.go

website/docs/d/hyok_customer_key_version.markdown

internal/provider/data_source_hyok_encrypted_data_key.go

iuri-slywitch-hashicorp · 2025-09-18T21:19:26Z

performed a terraform plan, worked as expected, here is the result:

iurislywitch@Iuris-MacBook-Pro test-tf-provider-tfe % terraform plan
╷
│ Warning: Provider development overrides are in effect
│ 
│ The following provider development overrides are set in the CLI configuration:
│  - hashicorp/tfe in /Users/iurislywitch/Desktop/terraform-provider-tfe
│ 
│ The behavior may therefore not match any released version of the provider and applying changes may cause the state to become incompatible with published releases.
╵
data.tfe_hyok_customer_key_version.tfe_hyok_customer_key_version1: Reading...
data.tfe_hyok_encrypted_data_key.tfe_hyok_encrypted_data_key1: Reading...
data.tfe_hyok_customer_key_version.tfe_hyok_customer_key_version1: Read complete after 1s [id=(redacted)]
data.tfe_hyok_encrypted_data_key.tfe_hyok_encrypted_data_key1: Read complete after 1s [id=(redacted)]

Changes to Outputs:
  + tfe_hyok_customer_key_version = {
      + created_at         = "2025-05-20T15:27:31Z"
      + error              = ""
      + id                 = "(redacted)"
      + key_version        = "(redacted)"
      + status             = "available"
      + workspaces_secured = 4
    }
  + tfe_hyok_encrypted_data_key   = {
      + created_at        = "2025-08-11T15:30:06Z"
      + customer_key_name = "aws-hyok-config"
      + encrypted_dek     = "(redacted)"
      + id                = "(redacted)"
    }

You can apply this plan to save these new output values to the Terraform state, without changing any real infrastructure.

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly these actions if you run "terraform apply" now.

iuri-slywitch-hashicorp · 2025-09-18T21:22:18Z

also, I ran the same go test cases on my end with my HYOK_CUSTOMER_KEY_VERSION_ID and HYOK_ENCRYPTED_DATA_KEY_ID, worked as expected, here is the result:

iurislywitch@Iuris-MacBook-Pro terraform-provider-tfe % TESTARGS="-run TestAccTFEHYOKCustomerKeyVersionDataSource" envchain STAGING_ENVCHAIN make testacc
TF_ACC=1 TF_LOG_SDK_PROTO=OFF go test $(go list ./... |grep -v 'vendor') -v -run TestAccTFEHYOKCustomerKeyVersionDataSource -timeout 15m
?       github.com/hashicorp/terraform-provider-tfe     [no test files]
testing: warning: no tests to run
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/client     0.419s [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/logging    0.413s [no tests to run]
=== RUN   TestAccTFEHYOKCustomerKeyVersionDataSource_basic
--- PASS: TestAccTFEHYOKCustomerKeyVersionDataSource_basic (2.09s)
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/provider   2.714s
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/helpers   [no test files]
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/planmodifiers     [no test files]
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/validators        [no test files]
?       github.com/hashicorp/terraform-provider-tfe/version     [no test files]
iurislywitch@Iuris-MacBook-Pro terraform-provider-tfe % TESTARGS="-run TestAccTFEHYOKEncryptedDataKeyDataSource" envchain STAGING_ENVCHAIN make testacc
TF_ACC=1 TF_LOG_SDK_PROTO=OFF go test $(go list ./... |grep -v 'vendor') -v -run TestAccTFEHYOKEncryptedDataKeyDataSource -timeout 15m
?       github.com/hashicorp/terraform-provider-tfe     [no test files]
testing: warning: no tests to run
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/client     0.335s [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/logging    0.167s [no tests to run]
=== RUN   TestAccTFEHYOKEncryptedDataKeyDataSource_basic
--- PASS: TestAccTFEHYOKEncryptedDataKeyDataSource_basic (2.06s)
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/provider   2.395s
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/helpers   [no test files]
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/planmodifiers     [no test files]
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/validators        [no test files]
?       github.com/hashicorp/terraform-provider-tfe/version     [no test files]

…hashicorp/terraform-provider-tfe into dominicretli/TF-28674/hyok-data-objects

iuri-slywitch-hashicorp

LGTM.

dominic-retli-hashi added 5 commits September 9, 2025 13:54

WIP testing new hyok customer key version resource

202a208

added data source for hyok encrypted data key and hyok customer key v…

4060a6a

…ersion, with some baseline tests that pass for me locally but need to be genericised

maded tests generic and dependent on env var

81ad65c

added mention of the env vars needed for the hyok data source tests i…

34dae45

…n testing.md

updated change log

8b846dc

dominic-retli-hashi marked this pull request as ready for review September 15, 2025 18:59

dominic-retli-hashi requested a review from a team as a code owner September 15, 2025 18:59

Merge branch 'main' into dominicretli/TF-28674/hyok-data-objects

2713372

helenjw reviewed Sep 16, 2025

View reviewed changes

internal/provider/data_source_hyok_customer_key_version.go Outdated Show resolved Hide resolved

internal/provider/data_source_hyok_customer_key_version.go Outdated Show resolved Hide resolved

internal/provider/data_source_hyok_encrypted_data_key.go Outdated Show resolved Hide resolved

iuri-slywitch-hashicorp reviewed Sep 17, 2025

View reviewed changes

internal/provider/data_source_hyok_customer_key_version.go Outdated Show resolved Hide resolved

dominic-retli-hashi added 5 commits September 17, 2025 16:21

Merge remote-tracking branch 'origin/main' into dominicretli/TF-28674…

5a1c9b2

…/hyok-data-objects

Added website docs for hyok data sources

49d4a3a

Added workspaces secured, general cleanup

6abdd35

updated docs

8457a54

test cleanup

66f2a61

helenjw reviewed Sep 18, 2025

View reviewed changes

internal/provider/data_source_hyok_encrypted_data_key.go Outdated Show resolved Hide resolved

website/docs/d/hyok_customer_key_version.markdown Outdated Show resolved Hide resolved

website/docs/d/hyok_customer_key_version.markdown Show resolved Hide resolved

iuri-slywitch-hashicorp reviewed Sep 18, 2025

View reviewed changes

internal/provider/data_source_hyok_encrypted_data_key.go Show resolved Hide resolved

dominic-retli-hashi changed the base branch from main to feature/hyok September 23, 2025 20:32

dominic-retli-hashi added 4 commits September 24, 2025 14:41

misc cleanup

44add6a

Merge branch 'feature/hyok' into dominicretli/TF-28674/hyok-data-objects

afa401b

renamed variable for lint

9a469a4

Merge branch 'dominicretli/TF-28674/hyok-data-objects' of github.com:…

a7622dd

…hashicorp/terraform-provider-tfe into dominicretli/TF-28674/hyok-data-objects

iuri-slywitch-hashicorp approved these changes Sep 25, 2025

View reviewed changes

iuri-slywitch-hashicorp changed the title ~~Add HYOK data sources for HYOKCustomerKeyVersion and HYOKEncryptedDataKey~~ [TF-28674] Add HYOK data sources for HYOKCustomerKeyVersion and HYOKEncryptedDataKey Sep 25, 2025

Maed223 approved these changes Sep 25, 2025

View reviewed changes

helenjw approved these changes Sep 26, 2025

View reviewed changes

Merge branch 'feature/hyok' into dominicretli/TF-28674/hyok-data-objects

8a2e80c

dominic-retli-hashi merged commit f192017 into feature/hyok Sep 26, 2025
19 checks passed

dominic-retli-hashi deleted the dominicretli/TF-28674/hyok-data-objects branch September 26, 2025 17:34

iuri-slywitch-hashicorp mentioned this pull request Sep 26, 2025

Hold Your Own Key Support #1862

Draft

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[TF-28674] Add HYOK data sources for HYOKCustomerKeyVersion and HYOKEncryptedDataKey #1842

[TF-28674] Add HYOK data sources for HYOKCustomerKeyVersion and HYOKEncryptedDataKey #1842

Uh oh!

dominic-retli-hashi commented Sep 15, 2025 •

edited

Loading

Uh oh!

helenjw left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

iuri-slywitch-hashicorp commented Sep 18, 2025 •

edited

Loading

Uh oh!

iuri-slywitch-hashicorp commented Sep 18, 2025

Uh oh!

iuri-slywitch-hashicorp left a comment

Uh oh!

Uh oh!

Uh oh!

[TF-28674] Add HYOK data sources for HYOKCustomerKeyVersion and HYOKEncryptedDataKey #1842

[TF-28674] Add HYOK data sources for HYOKCustomerKeyVersion and HYOKEncryptedDataKey #1842

Uh oh!

Conversation

dominic-retli-hashi commented Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Testing plan

External links

Output from acceptance tests

Rollback Plan

Changes to Security Controls

Uh oh!

helenjw left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

iuri-slywitch-hashicorp commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

iuri-slywitch-hashicorp commented Sep 18, 2025

Uh oh!

iuri-slywitch-hashicorp left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

dominic-retli-hashi commented Sep 15, 2025 •

edited

Loading

iuri-slywitch-hashicorp commented Sep 18, 2025 •

edited

Loading