generated from terraform-ibm-modules/terraform-ibm-module-template
-
Notifications
You must be signed in to change notification settings - Fork 1
Closed
Labels
Description
Problem:
In https://github.com/terraform-ibm-modules/terraform-ibm-cloud-monitoring/blob/main/main.tf a resource key is always created. Consumers are reporting it is hard to follow secret rotation best practises because:
- 1 key is always created - even if its not needed
- You currently cannot rotate the key value using terraform. Simply changing the value of
manager_key_namewill not rotate the key. - You really need the ability to have 2 active keys at any given time to be able to rotate key consumers (e.g. sysdig agents) non disruptively
- Secrets Manager does not yet support managing service credentials for the Cloud Monitoring service.
Proposal (suggest a deep dive first):
- Remove the
manager_key_nameinput and replace it with a new inputresource_keys(copy this approach)
Considerations:
- Should the default value of
resource_keysbe a way where it will create the manager key by default? Or it should create no key by default? - This will be a breaking change that will impact consumers. How should we handle?