terraform-provider-stackgen

sg_external_secret_formats (Data Source)

Lists supported Vault external-secret integration formats and metadata key definitions. Read-only catalog; does not return credential values or defaults.

Example Usage

# Read the required metadata key names before configuring sg_external_secret.
# The catalog returns definitions only, never credential values.
# WARNING: Values supplied to sg_external_secret.metadata remain in Terraform
# state; protect the state backend and do not commit credentials.
data "sg_external_secret_formats" "aws" {
  subcategory = "aws_secrets_manager"
}

output "aws_external_secret_required_keys" {
  value = flatten([
    for format in data.sg_external_secret_formats.aws.formats : [
      for key in format.keys : key.key if key.required
    ]
  ])
}

Operational notes

Lists supported configuration keys and select options, never credential values or defaults. Use with sg_external_secret.

Schema

Optional

• subcategory (String) Optional exact Vault external-secret subcategory filter; when omitted all supported formats are returned.

Read-Only

• formats (Attributes List) Supported external-secret integration formats and their key definitions; never includes credential values. (see below for nested schema)

Nested Schema for formats

Read-Only:

• category (String) Vault category of this external-secret format.
• keys (Attributes List) Definitions of configuration keys expected by this format; values and defaults are not returned. (see below for nested schema)
• label (String) Display label for this external-secret format; empty if unspecified.
• logo (String) Logo URL for this external-secret format; empty if unspecified.
• subcategory (String) Vault subcategory used when creating an external-secret integration.

Nested Schema for formats.keys

Read-Only:

• description (String) Help text for the configuration key; empty if unspecified.
• key (String) Lowercase metadata key name, not its credential value.
• label (String) Human-readable key label; empty if unspecified.
• mask (Boolean) Whether Vault treats the key’s value as sensitive and masks it on reads.
• options (List of String) Allowed choices for a select-type key; empty for other keys.
• required (Boolean) Whether this key must be supplied when configuring the integration.
• type (String) Input type for the configuration key, such as string or select.