Ephemeral google_secret_manager_secret_version does not properly set version after open

[LeeSaferite]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Terraform Version & Provider Version(s)

Terraform v1.12.2
on linux_amd64

• provider registry.terraform.io/hashicorp/google v7.10.0
• provider registry.terraform.io/hashicorp/google-beta v7.10.0

Affected Resource(s)

ephemeral.google_secret_manager_secret_version

Terraform Configuration

ephemeral google_secret_manager_secret_version "test" {
  secret = google_secret_manager_secret.test.id
}

Debug Output

No response

Expected Behavior

I would expect that with a missing version in the ephemeral resource definition it would load the "latest" secret version which it does. I would also expect that version would show the loaded version, like data.google_secret_manager_secret_version, which it does not.

Actual Behavior

The version attribute is unchanged from what was provided as the version argument.

NOTE: I know the distinction between argument/attribute is minimal and they use the same struct, but in this scenario the data resource is updating the version value to match what was actually loaded when using the "latest" attribute.

Steps to reproduce

1. terraform apply

Important Factoids

No response

References

Ref to data version: https://github.com/hashicorp/terraform-provider-google/blob/v7.10.0/google/services/secretmanager/data_source_secret_manager_secret_version.go#L157-L159

b/462810537

[ggtisc]

Hi @LeeSaferite

Are you looking to retrieve and know the value of google_secret_manager_secret.test.id? If that is the case you may need an output instead of an ephemeral data. If not please tell us what you are looking for and share with us the full code of your google_secret_manager_secret resource and all other relevant resources without locals, variables or modules. For sensitive data you could use examples like:

project = "my-project"
user = "my-user@my-domain.com"
org_id = 1234567890

[LeeSaferite]

No, I'm wanting to get the version of the latest ephemeral.google_secret_manager_secret_version for a google_secret_manager_secret.

I can already do this using data.google_secret_manager_secret as it (correctly IMO) updates the version attribute based on the loaded resource. If you don't pass a version attribute when defining the resource, it defaults to loading the "latest" alias, which results in the version attribute containing the value for the latest version (not null, "", or "latest")

This ticket is simply pointing out that the behavior of the data resource is not matched by the ephemeral resource in regards to the version attribute.

It's a trivial change that can be copied directly from the data resource. Without this being fixed, if I need to get the latest secret version name and the ephemeral secret data, I have to have both data and ephemeral resources and have to hit the API twice.

NOTE: I included a ref to the code showing what I'm talking about. You can see where the data resource is updating the version attribute.

[LeeSaferite]

Just as some background, I'm creating the google_secret_manager_secret and the initial google_secret_manager_secret_version in a module, but I'm using ephemeral.google_secret_manager_secret_version to get back the secret to use in other resources. If I pass version to ephemeral.google_secret_manager_secret_version based on the version from the initial google_secret_manager_secret_version resource, then I won't capture if the secret was updated externally. So, when I define the ephemeral.google_secret_manager_secret_version resource, I'm leaving out the version with the expectation that it should load the latest version (it does) and populate version with this information (it does not).

[ggtisc]

Thanks @LeeSaferite

Could you share with us your full code without using variables, locals or modules to see what is happening? For sensitive data you could use examples like:

project = "my-project"
user = "my-user@my-domain.com"
org_id = 1234567890

[LeeSaferite]

I have a module with roughly this code in it. The idea is that it defines the secret, generates an initial random ephemeral password, sets that password as the first secret version, then returns the ephemeral secret_data and version as part of the module output. Importantly returning the secret_data and version is coming from the ephemeral resource so that on each run it's returning the "latest" secret version for down-stream use. Given that using ephemeral values is done using write-only arguments along-side a "write-only version number" for that argument and the only way you trigger an update of the write-only value is by updating the "write-only version number", I was wanting to use the version for the actual latest secret to drive that "version". I can use a data resource to do this currently, but as I'm already loading the ephemeral resource to get an ephemeral version of the secret, I was trying to avoid a duplicate load caused by using the data resource. It seems like I'm just going to use that data resource at this point though.

Example

terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "7.11.0"
    }
  }
}

variable secret_id {
  type = string
}

data google_secret_manager_secret "test" {
  secret_id = var.secret_id
}

data google_secret_manager_secret_version "test" {
  secret = data.google_secret_manager_secret.test.id
}
ephemeral google_secret_manager_secret_version "test" {
  secret = data.google_secret_manager_secret.test.id
}

output data_secret_version {
  value = data.google_secret_manager_secret_version.test.version
  sensitive = false
}
output ephemeral_secret_version {
  value = ephemeral.google_secret_manager_secret_version.test.version
  ephemeral = true
  sensitive = false
}

With the ephemeral resource version

The ephemeral_secret_version output is ""

You can see where the resource uses "latest" as the default value here: https://github.com/hashicorp/terraform-provider-google/blob/v7.11.0/google/services/secretmanager/ephemeral_google_secret_manager_secret_version.go#L146-L149

You can see where version is not updated here: https://github.com/hashicorp/terraform-provider-google/blob/v7.11.0/google/services/secretmanager/ephemeral_google_secret_manager_secret_version.go#L198-L206

With the data resource

The data_secret_version output is "2" (or whatever the latest version is)

You can see where the resource uses the "latest" as the default value here: https://github.com/hashicorp/terraform-provider-google/blob/v7.11.0/google/services/secretmanager/data_source_secret_manager_secret_version.go#L118-L128

You can see where version is updated here: https://github.com/hashicorp/terraform-provider-google/blob/v7.11.0/google/services/secretmanager/data_source_secret_manager_secret_version.go#L157-L159

You can see that version is marked as "optional" and "computed": https://github.com/hashicorp/terraform-provider-google/blob/v7.11.0/google/services/secretmanager/data_source_secret_manager_secret_version.go#L45-L49

Summary

My whole reason for opening this ticket was simply to point out that the data resource makes sure that version is set and usable as a down-stream attribute, even if it's not initially provided but that the ephemeral resource does not do the same thing. That seems like an oversight and/or unexpected behavior to me and the fix is trivial as the code already exists in the data resource.