Add name_prefix attribute to aws_secretsmanager_secret

[garyp]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

AWS secrets are by default kept around for a few days after being deleted so they can be recovered. This causes creation of aws_secretsmanager_secret resources to fail when doing a terraform apply immediately after a terraform destroy, since the secret still exists in AWS (even though it is marked for deletion). The recommended terraform solution is to set recovery_window_in_days = 0 so that the secret is deleted immediately on destroy.

For some use cases we want the extra protection that recovery_window_in_days > 0 provides, so we don't accidentally blow away an important secret. In those cases it'd be helpful to use name_prefix to still allow a new version of the secret to be deleted before the old version has expired.

New or Affected Resource(s)

• aws_secretsmanager_secret

Potential Terraform Configuration

resource "aws_secretsmanager_secret" "db_password" {
  name_prefix = "db-password-"
}

References

• aws_secretsmanager_secret recreate #4467

[bflad]

The name_prefix argument has been merged and will release with version 1.42.0 of the AWS provider, likely in the next few days.

[bflad]

This has been released in version 1.42.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!