terraform-provider-stackgen

sg_external_secret (Resource)

Manages an external secret integration in StackGen Vault. Import by Vault UUID. Deletion is non-forced by default: Vault rejects deletion of an in-use integration with HTTP 409. Set force_delete = true only when it is safe to break dependent secrets. Sensitive metadata remains in Terraform state even if Vault redacts it on read.

Example Usage

# Requires a Vault-supported external-secret format. Check
# data.sg_external_secret_formats for the required metadata keys of your format.
# WARNING: Credential metadata remains in Terraform state even if Vault redacts it
# on read. Use a protected, encrypted state backend and never commit tfstate/tfvars.
resource "sg_external_secret" "example" {
  name        = "example-aws-external"
  description = "External secrets from AWS Secrets Manager"
  subcategory = "aws_secrets_manager"
  metadata    = var.external_secret_metadata
}

variable "external_secret_metadata" {
  description = "Placeholder: supply the required AWS Secrets Manager integration credential keys from the Vault format catalog via a secure variable source."
  type        = map(string)
  sensitive   = true
}

Import

Import an existing sg_external_secret using its external secret UUID:

terraform import sg_external_secret.example '123e4567-e89b-12d3-a456-426614174000'

Operational notes

Vault refuses to delete an in-use external secret (HTTP 409) unless force_delete = true. Prefer removing dependent sg_secret.external_secret_references first. Credential metadata stays in Terraform state even when Vault redacts reads; secure plans and state.

Schema

Required

• name (String) Unique external secret integration name. Changing it recreates the integration.
• subcategory (String) Vault external secret subcategory. Changes require replacement.

Optional

• category (String) External secret provider category (for example aws or azure). Set on creation; changes require replacement.
• description (String) Human-readable description of the external secret integration.
• force_delete (Boolean) Allow deletion while the external secret is referenced by other secrets. Default false; forcing deletion may break dependent secrets.
• metadata (Map of String, Sensitive) Credential metadata key/value pairs required by the selected subcategory. Vault may redact values on read. Terraform state still contains submitted secrets; protect it. An explicit empty map clears metadata on update.
• org_id (String) Organization ID to scope Vault operations; defaults to the provider workspace_id.
• shared_with (Set of String) IDs of organizations or users that may use this external secret. An explicit empty set clears sharing.

Read-Only

• created_at (String) Vault creation timestamp (RFC 3339).
• id (String) Vault-assigned external secret UUID. Import using this ID.
• owner (String) ID of the owner assigned by Vault.
• updated_at (String) Vault last-update timestamp (RFC 3339).