google_secret_manager_secret: support for automatic replication with CMEK

[jcanseco]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

The Secret Manager API allows Secrets to have automatic replication with customer-managed encryption keys (see the replication.automatic.customerManagedEncryption field).

However, the ability to configure Secrets in this manner is not exposed to users via the google_secret_manager_secret resource (see how its replication.automatic field is a boolean field instead of an object field).

The request is to support this feature in google_secret_manager_secret.

Since the resource already has a replication.automatic field, perhaps one approach that maintains backwards compatibility is to introduce a new field to expose the feature (replication.automatic_replication?).

New or Affected Resource(s)

• google_secret_manager_secret

Potential Terraform Configuration

resource "google_secret_manager_secret" "my-secret" {
  secret_id = "my-secret"
  replication {
    automatic_replication {
      customerManagedEncryption {
          kmsKeyName = google_kms_crypto_key.your_key.self_link
      }
    }
  }
}

References

• Requested by a Config Connector user; considered as a friction point: Support for CMEK with Automatic Replication on SecretManagerSecret GoogleCloudPlatform/k8s-config-connector#481

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.