[Feature]: Support write-only password attributes in storage-boxes subaccounts

[Dryusdan]

What whould you like to see?

Hello :)

Recently Opentofu support ephemeral ressources (available in terraform since 1.10), so I try to make a subaccounts in my storage box for each vm I have create.

Because we can add an SSH key on a storage box subaccounts via API, I generate a random password, store it into my vault, then I run a playbook to install and configure borgmatic (using password stored in vault).

data "hcloud_storage_box" "backup" {
  name = "backup"
}

ephemeral "random_password" "backup_password" {
  for_each         = var.incus_servers

  length           = 128
  special          = true
  override_special = "ÄÖÜäöü^°!§$%/()=?+#-.,;:~*@{}_&"
}

resource "vault_kv_secret_v2" "db_root" {
  for_each         = var.incus_servers

  mount        = var.vault_kv_engine
  name 			     = "storage-boxes/${each.key}"
  data_json_wo                  = jsonencode(
    {
      password       = ephemeral.random_password.backup_password[each.key].result
    }
  )
}

resource "hcloud_storage_box_subaccount" "team_badger" {
  for_each         = var.incus_servers

  storage_box_id = data.hcloud_storage_box.backup.id
  description = each.key

  home_directory = "borg/${each.key}"
  password       = ephemeral.random_password.backup_password[each.key].result

  access_settings = {
    reachable_externally = true
    ssh_enabled = true
  }

  labels = {
    env  = "production"
    tool = "terraform"
  }
}

But terraform send this error

Attribute ".password" is referencing an ephemeral value but ephemeral values can be referenced only by other ephemeral attributes or by write-only ones.

Vault provider (for exemple) add an attribute name data_json_wo instead of data_json to write only and don't log anywhere the password.

So, I think for a fully and securelly automation, a password_wo attribute can be amazing !

Thank :)
Have a nice day

[apricote]

Thanks for the suggestion @Dryusdan.

With write-only attributes we do not have access to the previous value, so we can not use it to check if we actually need to update the password in the API. Looking at the terraform docs for write-only attributes we have two options:

1. Add a write-only password_wo attribute/make password write-only and make that we have to update the password on every invocation, causing a lot of unnecessary API requests.

• Possibly: Add some "trigger" keyword that the user can change to signal us to update the password, but this feels dirty

2. Add a hash of the configured password to our private state and only call the API if this hash changes

[Dryusdan]

Thank for your answer @apricote 😊

I understand write-only attribute with ephemeral resource differently (with https://developer.hashicorp.com/terraform/language/manage-sensitive-data/ephemeral but I have not made my own terraform provider ^^ ) .
Write-only attribute is only for ephemeral resource and not for standard resource. Ephemeral resource isn't updated in each apply but data will not be stored. But password cannot be updated, just created one time indeed.

[googol]

@Dryusdan ephemeral resources are like the previously existing data sources, but all of their attributes are ephemeral, meaning they won't be written into the state backend. You'll see that in your example too the write-only attribute is on the standard resource vault_kv_secret_v2, and the value for that is coming from the ephemeral resource ephemeral.random_password.backup_password.

So ephemeral resources read ephemeral values, and write-only attributes are the only valid place to write them!

@apricote I hope you guys have a discussion on what model you want to go with. The hashicorp official providers seem to have chosen the _version model, and the keepers model isn't that bad either (it seems more clear to me than the opaque version number since you can actually refer to the sources that trigger the change). At this point of ephemeral/WO adoption on my part I personally don't have a strong preference for any of these solutions specifically, but would love to get support for them. I'm about to make a request for a write-only attribute on another resource