【问题标题】：aws_secretsmanager_secret key/value Pair Example (Based On Terraform Docs) Doesn't Work With Randomly Generated Passwordsaws_secretsmanager_secret 键/值对示例（基于 Terraform 文档）不适用于随机生成的密码
【发布时间】：2021-10-31 10:10:17
【问题描述】：

目标是什么？

采用以下解决方案（使用随机密码生成秘密管理器秘密）并从明文秘密转移到键/值秘密。

Plaintext Secretsmanager 秘密解决方案

resource "random_password" "default_password" {
  length           = 20
  special          = false
}

# NOTE: Since we aren't specifying a KMS key this will default to using
# `aws/secretsmanager`/
resource "aws_secretsmanager_secret" "user_default" {
  name        = "user/default"
  tags        = local.tags
}

resource "aws_secretsmanager_secret_version" "secret_val" {
  secret_id     = aws_secretsmanager_secret.user_default.id
  secret_string = random_password.default_password.result
}

这是一个功能性解决方案，它使用随机生成的密码生成明文秘密

尝试的解决方案

这是我基于terraform docs for secretsmanager_secret_version 尝试的第一个解决方案，不幸的是它不适用于随机生成的密码

  // TODO: Generalize this to produce a password once per (username, company)
  //       tuple in a list.
  resource "random_password" "default_password" {
    length           = 20
    special          = false
  }

  # NOTE: Since we aren't specifying a KMS key this will default to using
  # `aws/secretsmanager`/
  resource "aws_secretsmanager_secret" "user_default" {
    name        = "user/default"
    tags        = local.tags
  }

  variable "secret_contents" {
    default = {
>>    password = random_password.default_password.result
      company = "test"
    }

    type = map(string)
  }

  resource "aws_secretsmanager_secret_version" "secret_val" {
    secret_id     = aws_secretsmanager_secret.user_default.id
    secret_string = jsonencode(var.secret_contents)
  }

这遇到了Variables may not be used here. 错误。

【问题讨论】：

secret_contents 必须是 local 而不是声明的 variable，因为默认值是基于应用期间生成的值。

标签： terraform aws-secrets-manager

【解决方案1】：

  resource "random_password" "default_password" {
    length           = 20
    special          = false
  }

  # NOTE: Since we aren't specifying a KMS key this will default to using
  # `aws/secretsmanager`/
  resource "aws_secretsmanager_secret" "user_default" {
    name        = "user/default"
    tags        = local.tags
  }

  resource "aws_secretsmanager_secret_version" "secret_val" {
    secret_id     = aws_secretsmanager_secret.user_default.id
    # TODO: Figure out a way to generate mapping structure that presents this
    #       key/value pair structure in a more readable way. Maybe use template files?
    secret_string = jsonencode({"password": "${random_password.default_password.result}"})
  }

将使用随机生成的密码生成密钥/值密钥

【讨论】：