Lists secrets from the StackGen Vault, with optional filtering by name, category (e.g. cloud, scm, LLM), or subcategory (e.g. aws, github, openai). Only summaries without credential values are returned; descriptive fields such as name and category remain visible.
# Inventory Vault secret descriptions and IDs without retrieving credential values.
# Scope with provider workspace_id (or set org_id on this data source).
data "sg_secrets" "github" {
category = "scm"
subcategory = "github"
}
output "github_secret_ids" {
value = [for secret in data.sg_secrets.github.secrets : secret.id]
}
This list contains only descriptive secret fields (name, category, description, IDs), not the credential-value metadata map. Descriptions are visible in outputs and state: never store credentials there. Importing sg_secret separately may put credentials into state; secure state and plans.
category (String) Filter secrets by category (e.g. cloud or scm or LLM).name (String) Filter secrets by exact name.org_id (String) Organization (project) ID to scope the query. Falls back to the provider-level workspace_id if omitted.subcategory (String) Filter secrets by subcategory / provider (e.g. aws or github).secrets (Attributes List) Summaries of matching secrets without credential values; descriptive metadata fields are included. (see below for nested schema)secretsRead-Only:
category (String) Category (e.g. cloud or scm).description (String) Human-readable description.id (String) Secret ID (UUID).name (String) Secret name.owner (String) UUID of the secret owner.owner_type (String) Type of the owner (User or Organization etc.).subcategory (String) Subcategory / provider (e.g. aws or github).