Add BYOK resource #330
Add BYOK resource #330
Conversation
There was a problem hiding this comment.
Thank you so much for doing this @emerkle826! Once these changes get merged and released, I'll get our code updated to use it. If you're open to it, I'd be happy to create a PR to add some example terraform that creates an AWS KMS key and configures Astra BYOK with it.
I left a few comments around clarifying expectations in documentation (specifically around not being able to delete keys via DevOps API, which has bitten us in the past).
Looking forward to using these! 🙂
docs/resources/customer_key.md
Outdated
| description: |- | ||
| astra_customer_key provides a Customer Key resource for Astra's Bring Your Own Key (BYOK). | ||
| --- |
There was a problem hiding this comment.
I think a support ticket is required to delete a customer key, which wouldn't be idiomatic for terraform providers normally - I think it is worth calling that out in the docs for the resource so people know that manual clean-up is required.
| } | ||
|
|
||
| func resourceCustomerKeyDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { | ||
| // Delete not yet supported via DevOps API |
There was a problem hiding this comment.
Would it be worth calling one of the diagnostic functions to return a warning to the user during a destroy run so they are aware manual cleanup is needed?
|
|
||
| # astra_cloud_accounts (Data Source) | ||
|
|
||
| Retrieve a list of Cloud Accounts within an Organization |
There was a problem hiding this comment.
This is probably more a of a question for the DevOps API folks, but will this only ever return an array of length 1, or are there situations where Astra organizations will have more than one cloud accounts for a given cloud provider and region?
I ask since the primary use case for this data source is to be able to feed it into an AWS KMS access policy, which would require creating an ARN based on the provider_id returned in this data source's response. I'm curious if it is safe to just refer to it with data.astra_cloud_accounts.this[0].provider_id, or if some HCL manipulation needs to be done to turn it into an array of provider IDs/ARNs for the KMS key policy.
There was a problem hiding this comment.
For GCP, I happen to have 2 accounts, so it can be more than 1. That may only be the case for GCP, but the code handles both AWS and GCP.
Fixes #320