aws_secretsmanager_secret 键/值对示例（基于 Terraform 文档）不适用于随机生成的密码

Question

目标是什么？

\n

采用以下解决方案（使用随机密码生成机密管理器机密）并从纯文本机密转移到键/值机密。

\n

明文 Secretsmanager 秘密解决方案

\n

resource "random_password" "default_password" {\n  length           = 20\n  special          = false\n}\n\n# NOTE: Since we aren\'t specifying a KMS key this will default to using\n# `aws/secretsmanager`/\nresource "aws_secretsmanager_secret" "user_default" {\n  name        = "user/default"\n  tags        = local.tags\n}\n\nresource "aws_secretsmanager_secret_version" "secret_val" {\n  secret_id     = aws_secretsmanager_secret.user_default.id\n  secret_string = random_password.default_password.result\n}\n

\n

这是一个功能性解决方案，可使用随机生成的密码生成明文机密\n

\n

尝试的解决方案

\n

这是我基于Secretsmanager_secret_version 的 terraform 文档尝试的第一个解决方案，不幸的是，它不适用于随机生成的密码

\n

  // TODO: Generalize this to produce a password once per (username, company)\n  //       tuple in a list.\n  resource "random_password" "default_password" {\n    length           = 20\n    special          = false\n  }\n\n  # NOTE: Since we aren\'t specifying a KMS key this will default to using\n  # `aws/secretsmanager`/\n  resource "aws_secretsmanager_secret" "user_default" {\n    name        = "user/default"\n    tags        = local.tags\n  }\n\n  variable "secret_contents" {\n    default = {\n>>    password = random_password.default_password.result\n      company = "test"\n    }\n\n    type = map(string)\n  }\n\n  resource "aws_secretsmanager_secret_version" "secret_val" {\n    secret_id     = aws_secretsmanager_secret.user_default.id\n    secret_string = jsonencode(var.secret_contents)\n  }\n

\n

这会出现Variables may not be used here.错误。

\n

Answer 1

  resource "random_password" "default_password" {
    length           = 20
    special          = false
  }

  # NOTE: Since we aren't specifying a KMS key this will default to using
  # `aws/secretsmanager`/
  resource "aws_secretsmanager_secret" "user_default" {
    name        = "user/default"
    tags        = local.tags
  }

  resource "aws_secretsmanager_secret_version" "secret_val" {
    secret_id     = aws_secretsmanager_secret.user_default.id
    # TODO: Figure out a way to generate mapping structure that presents this
    #       key/value pair structure in a more readable way. Maybe use template files?
    secret_string = jsonencode({"password": "${random_password.default_password.result}"})
  }

将使用随机生成的密码生成键/值秘密