terraform-provider-stackgen

sg_vault_secret_metadata_keys (Data Source)

Lists Vault-supported sg_secret.metadata keys per category/subcategory (from GET /support/metadata). Use this to discover required keys for AWS, GCP, SCM, and other types instead of guessing from examples. Credential values are never returned. Unknown Vault subcategories are tolerated so a newer catalog cannot break this data source.

Example Usage

# When to use: Discover required sg_secret.metadata keys for a category/subcategory
# before writing HCL. Never returns secret values.
data "sg_vault_secret_metadata_keys" "aws" {
  category    = "CloudProvider"
  subcategory = "aws"
}

output "aws_required_keys" {
  value = [
    for format in data.sg_vault_secret_metadata_keys.aws.formats : [
      for key in format.keys : key.key if key.required
    ]
  ]
}

Operational notes

Use this catalog to build sg_secret.metadata for each category/subcategory. It does not return secret values.

Schema

Optional

• category (String) Optional category filter (e.g. CloudProvider, scm, LLM).
• subcategory (String) Optional subcategory filter (e.g. aws, github, gcp).

Read-Only

• formats (Attributes List) Supported Vault secret formats and their metadata keys. (see below for nested schema)

Nested Schema for formats

Read-Only:

• category (String) Secret category.
• keys (Attributes List) Metadata keys accepted for this category/subcategory. (see below for nested schema)
• label (String) Human-readable label when returned by Vault.
• subcategory (String) Secret subcategory / provider.

Nested Schema for formats.keys

Read-Only:

• default (String) Default value when Vault supplies one.
• description (String) Key description from Vault.
• key (String) Metadata map key (lowercase).
• label (String) Human-readable key label.
• mask (Boolean) Whether Vault masks the value in UI responses.
• required (Boolean) Whether Vault requires this key.
• type (String) Key definition type (string, select, etc.).