Add HYOK data sources for HYOKCustomerKeyVersion and HYOKEncryptedDataKey #1842

dominic-retli-hashi · 2025-09-15T18:13:10Z

Description

added data source for HYOKCustomerKeyVersion
added data source for HYOKEncryptedDataKey
added test coverage for the data sources (the tests rely on the presence of env variables to speicify the IDs of the records in the database).

TODO: Update the website docs for new datasources

Remember to:

Update the Change Log
Update the Documentation

Testing plan

Using a version of Hold Your Own Key Support go-tfe#1201 and using an organization with access to HYOK
Use a terraform configuration with outputs to read HYOK data source via terraform plan and terraform apply.

data "tfe_hyok_customer_key_version" "tfe_hyok_customer_key_version1" {
  id = "keyv-<your-id>"
}

output "customer_key_version" {
  value = data.tfe_hyok_customer_key_version.tfe_hyok_customer_key_version1
}

data "tfe_hyok_encrypted_data_key" "tfe_hyok_encrypted_data_key1" {
  id = "dek-<your-id>"
}

output "tfe_hyok_encrypted_data_key" {
  value = data.tfe_hyok_encrypted_data_key.tfe_hyok_encrypted_data_key1
}

Example Output of a Terraform Run:

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

customer_key_version = {
  "created_at" = "2025-09-09T17:27:14Z"
  "error" = ""
  "id" = "keyv-BWZTzt2J75DsdwH8"
  "key_version" = "10"
  "status" = "available"
  "workspaces_secured" = 2
}
tfe_hyok_encrypted_data_key = {
  "created_at" = "2025-09-09T17:27:14Z"
  "customer_key_name" = "tf-rocket-hyok-oasis"
  "encrypted_dek" = "dmF1bHQ6djEwOjdFb3gzNERXQ05zNGVNelNSb09waWp3dGE4SmlNa0JjWFRsQ25KbXlRNlZWRGpCbnFtOFBvbGkvb1ZGTkQ3UVFybDNoNzBrT2hScnlHUlZS"
  "id" = "dek-wuLiejfGtNLLuiH9"
}

External links

Include any links here that might be helpful for people reviewing your PR. If there are none, feel free to delete this section.

Output from acceptance tests

Please run applicable acceptance tests locally and include the output here. See testing.md to learn how to run acceptance tests.

If you are an external contributor, your contribution(s) will first be reviewed before running them against the project's CI pipeline.

TESTARGS="-run TestAccTFEHYOKCustomerKeyVersionDataSource" make testacc
TF_ACC=1 TF_LOG_SDK_PROTO=OFF go test $(go list ./... |grep -v 'vendor') -v -run TestAccTFEHYOKCustomerKeyVersionDataSource -timeout 15m
?       github.com/hashicorp/terraform-provider-tfe     [no test files]
testing: warning: no tests to run
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/client     0.187s [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/logging    0.294s [no tests to run]
=== RUN   TestAccTFEHYOKCustomerKeyVersionDataSource_basic
--- PASS: TestAccTFEHYOKCustomerKeyVersionDataSource_basic (0.93s)
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/provider   1.266s
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/helpers   [no test files]
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/planmodifiers     [no test files]
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/validators        [no test files]
?       github.com/hashicorp/terraform-provider-tfe/version     [no test files]

TESTARGS="-run TestAccTFEHYOKEncryptedDataKeyDataSource" make testacc
TF_ACC=1 TF_LOG_SDK_PROTO=OFF go test $(go list ./... |grep -v 'vendor') -v -run TestAccTFEHYOKEncryptedDataKeyDataSource -timeout 15m
?       github.com/hashicorp/terraform-provider-tfe     [no test files]
testing: warning: no tests to run
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/client     0.299s [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/logging    0.150s [no tests to run]
=== RUN   TestAccTFEHYOKEncryptedDataKeyDataSource_basic
--- PASS: TestAccTFEHYOKEncryptedDataKeyDataSource_basic (1.12s)
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/provider   1.439s
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/helpers   [no test files]
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/planmodifiers     [no test files]
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/validators        [no test files]
?       github.com/hashicorp/terraform-provider-tfe/version     [no test files]

Rollback Plan

Changes to Security Controls

…ersion, with some baseline tests that pass for me locally but need to be genericised

…n testing.md

helenjw

I tested the data sources and they're working for me! Just a few nits and something I gotta do on the go-tfe end

internal/provider/data_source_hyok_customer_key_version.go

internal/provider/data_source_hyok_encrypted_data_key.go

internal/provider/data_source_hyok_customer_key_version.go

…/hyok-data-objects

helenjw · 2025-09-18T15:53:51Z

internal/provider/data_source_hyok_encrypted_data_key.go

+	// Set the computed attributes from the API response
+	data.EncryptedDEK = types.StringValue(keyVersion.EncryptedDEK)
+	data.CustomerKeyName = types.StringValue(keyVersion.CustomerKeyName)
+	data.CreatedAt = types.StringValue(keyVersion.CreatedAt.Format(time.RFC3339)) // TODO DOM: Check this format


Nit: this can probably be removed!

helenjw · 2025-09-18T15:58:05Z

website/docs/d/hyok_customer_key_version.markdown

+
+```hcl
+data "tfe_hyok_customer_key_version" "tfe_hyok_customer_key_version1" {
+  id = "keyv-<your-id>"


Non blocker: but it seems like some other id examples do not include <>. (eg. website/docs/d/team_project_access.html.markdown)

So maybe something like

Suggested change

id = "keyv-<your-id>"

id = "my-key-version-id"

Helen, that's because the customer key version follows the pattern "keyv-####" where # is some id.

helenjw · 2025-09-18T15:59:27Z

website/docs/d/hyok_customer_key_version.markdown

+---
+layout: "tfe"
+page_title: "Terraform Enterprise: tfe_agent_pool"
+description: |-
+  Get information on an agent pool.
+---


This and the section at website/docs/d/hyok_encrypted_data_key.markdown should probably be changed from agent pool stuff

iuri-slywitch-hashicorp · 2025-09-18T18:44:45Z

internal/provider/data_source_hyok_encrypted_data_key.go

+
+	// Make API call to fetch the HYOK customer key version
+	keyVersion, err := d.config.Client.HYOKEncryptedDataKeys.Read(ctx, data.ID.ValueString())
+	if err != nil {


should we have that same condition Helen's PR for "Resource not found" if-statement?

iuri-slywitch-hashicorp · 2025-09-18T21:19:26Z

performed a terraform plan, worked as expected, here is the result:

iurislywitch@Iuris-MacBook-Pro test-tf-provider-tfe % terraform plan
╷
│ Warning: Provider development overrides are in effect
│ 
│ The following provider development overrides are set in the CLI configuration:
│  - hashicorp/tfe in /Users/iurislywitch/Desktop/terraform-provider-tfe
│ 
│ The behavior may therefore not match any released version of the provider and applying changes may cause the state to become incompatible with published releases.
╵
data.tfe_hyok_customer_key_version.tfe_hyok_customer_key_version1: Reading...
data.tfe_hyok_encrypted_data_key.tfe_hyok_encrypted_data_key1: Reading...
data.tfe_hyok_customer_key_version.tfe_hyok_customer_key_version1: Read complete after 1s [id=(redacted)]
data.tfe_hyok_encrypted_data_key.tfe_hyok_encrypted_data_key1: Read complete after 1s [id=(redacted)]

Changes to Outputs:
  + tfe_hyok_customer_key_version = {
      + created_at         = "2025-05-20T15:27:31Z"
      + error              = ""
      + id                 = "(redacted)"
      + key_version        = "(redacted)"
      + status             = "available"
      + workspaces_secured = 4
    }
  + tfe_hyok_encrypted_data_key   = {
      + created_at        = "2025-08-11T15:30:06Z"
      + customer_key_name = "aws-hyok-config"
      + encrypted_dek     = "(redacted)"
      + id                = "(redacted)"
    }

You can apply this plan to save these new output values to the Terraform state, without changing any real infrastructure.

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly these actions if you run "terraform apply" now.

iuri-slywitch-hashicorp · 2025-09-18T21:22:18Z

also, I ran the same go test cases on my end with my HYOK_CUSTOMER_KEY_VERSION_ID and HYOK_ENCRYPTED_DATA_KEY_ID, worked as expected, here is the result:

iurislywitch@Iuris-MacBook-Pro terraform-provider-tfe % TESTARGS="-run TestAccTFEHYOKCustomerKeyVersionDataSource" envchain STAGING_ENVCHAIN make testacc
TF_ACC=1 TF_LOG_SDK_PROTO=OFF go test $(go list ./... |grep -v 'vendor') -v -run TestAccTFEHYOKCustomerKeyVersionDataSource -timeout 15m
?       github.com/hashicorp/terraform-provider-tfe     [no test files]
testing: warning: no tests to run
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/client     0.419s [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/logging    0.413s [no tests to run]
=== RUN   TestAccTFEHYOKCustomerKeyVersionDataSource_basic
--- PASS: TestAccTFEHYOKCustomerKeyVersionDataSource_basic (2.09s)
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/provider   2.714s
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/helpers   [no test files]
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/planmodifiers     [no test files]
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/validators        [no test files]
?       github.com/hashicorp/terraform-provider-tfe/version     [no test files]
iurislywitch@Iuris-MacBook-Pro terraform-provider-tfe % TESTARGS="-run TestAccTFEHYOKEncryptedDataKeyDataSource" envchain STAGING_ENVCHAIN make testacc
TF_ACC=1 TF_LOG_SDK_PROTO=OFF go test $(go list ./... |grep -v 'vendor') -v -run TestAccTFEHYOKEncryptedDataKeyDataSource -timeout 15m
?       github.com/hashicorp/terraform-provider-tfe     [no test files]
testing: warning: no tests to run
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/client     0.335s [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/logging    0.167s [no tests to run]
=== RUN   TestAccTFEHYOKEncryptedDataKeyDataSource_basic
--- PASS: TestAccTFEHYOKEncryptedDataKeyDataSource_basic (2.06s)
PASS
ok      github.com/hashicorp/terraform-provider-tfe/internal/provider   2.395s
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/helpers   [no test files]
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/planmodifiers     [no test files]
?       github.com/hashicorp/terraform-provider-tfe/internal/provider/validators        [no test files]
?       github.com/hashicorp/terraform-provider-tfe/version     [no test files]

dominic-retli-hashi added 5 commits September 9, 2025 13:54

WIP testing new hyok customer key version resource

202a208

added data source for hyok encrypted data key and hyok customer key v…

4060a6a

…ersion, with some baseline tests that pass for me locally but need to be genericised

maded tests generic and dependent on env var

81ad65c

added mention of the env vars needed for the hyok data source tests i…

34dae45

…n testing.md

updated change log

8b846dc

dominic-retli-hashi marked this pull request as ready for review September 15, 2025 18:59

dominic-retli-hashi requested a review from a team as a code owner September 15, 2025 18:59

Merge branch 'main' into dominicretli/TF-28674/hyok-data-objects

2713372

helenjw reviewed Sep 16, 2025

View reviewed changes

internal/provider/data_source_hyok_customer_key_version.go Outdated Show resolved Hide resolved

internal/provider/data_source_hyok_customer_key_version.go Outdated Show resolved Hide resolved

internal/provider/data_source_hyok_encrypted_data_key.go Outdated Show resolved Hide resolved

iuri-slywitch-hashicorp reviewed Sep 17, 2025

View reviewed changes

internal/provider/data_source_hyok_customer_key_version.go Outdated Show resolved Hide resolved

dominic-retli-hashi added 5 commits September 17, 2025 16:21

Merge remote-tracking branch 'origin/main' into dominicretli/TF-28674…

5a1c9b2

…/hyok-data-objects

Added website docs for hyok data sources

49d4a3a

Added workspaces secured, general cleanup

6abdd35

updated docs

8457a54

test cleanup

66f2a61

helenjw reviewed Sep 18, 2025

View reviewed changes

iuri-slywitch-hashicorp reviewed Sep 18, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add HYOK data sources for HYOKCustomerKeyVersion and HYOKEncryptedDataKey #1842

Add HYOK data sources for HYOKCustomerKeyVersion and HYOKEncryptedDataKey #1842

Uh oh!

dominic-retli-hashi commented Sep 15, 2025 •

edited

Loading

Uh oh!

helenjw left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

helenjw Sep 18, 2025

Uh oh!

helenjw Sep 18, 2025

Uh oh!

iuri-slywitch-hashicorp Sep 18, 2025

Uh oh!

helenjw Sep 18, 2025

Uh oh!

iuri-slywitch-hashicorp Sep 18, 2025

Uh oh!

iuri-slywitch-hashicorp commented Sep 18, 2025 •

edited

Loading

Uh oh!

iuri-slywitch-hashicorp commented Sep 18, 2025

Uh oh!

Uh oh!

Add HYOK data sources for HYOKCustomerKeyVersion and HYOKEncryptedDataKey #1842

Are you sure you want to change the base?

Add HYOK data sources for HYOKCustomerKeyVersion and HYOKEncryptedDataKey #1842

Uh oh!

Conversation

dominic-retli-hashi commented Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Testing plan

External links

Output from acceptance tests

Rollback Plan

Changes to Security Controls

Uh oh!

helenjw left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

helenjw Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

helenjw Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

iuri-slywitch-hashicorp Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

helenjw Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

iuri-slywitch-hashicorp Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

iuri-slywitch-hashicorp commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

iuri-slywitch-hashicorp commented Sep 18, 2025

Uh oh!

Uh oh!

dominic-retli-hashi commented Sep 15, 2025 •

edited

Loading

iuri-slywitch-hashicorp commented Sep 18, 2025 •

edited

Loading