Add resource to add secrets to secret manager

[dome-meg]

Problem description

I create a user via terraform for our postgres DB.

resource "stackit_postgresflex_user" "user" {
  project_id  = var.project_id
  instance_id = stackit_postgresflex_instance.main.instance_id
  username    = "project_${var.environment}_user"
  roles       = ["login"]
}

The resource expose some important outputs:

• stackit_postgresflex_user.user.uri
• stackit_postgresflex_user.user.password

To get access to the password:

• They are not readable in the portal and so I can only recreate a new password in the portal to see it.
• I export it with terraform apply

Proposed solution

# ALREADY EXISTING:

resource "stackit_secretsmanager_instance" "example" {
  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  name       = "example-instance"
  acls       = ["XXX.XXX.XXX.X/XX", "XX.XXX.XX.X/XX"]
}

resource "stackit_secretsmanager_secret" "database_uri" {
  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  instance_id = stackit_secretsmanager_instance.example.instance_id
  name       = "our database credentials"
  secrets = {
    db_uri = stackit_postgresflex_user.user.uri
  }
}

[Fyusel]

Hi @dome-meg,
thank you for reporting this issue.

Currently, creating and managing actual secrets is not supported directly via the STACKIT API. Instead, the STACKIT Secrets Manager provides a HashiCorp Vault-compatible API, so you need to interact directly with the Vault API/CLI to handle the secrets themselves. You can find more details about this in our official documentation: CLI and API for Secrets Manager.

Because of this underlying architecture, we cannot currently implement a resource for creating secrets directly within the STACKIT Terraform Provider.

I will forward your feedback and this use case to the responsible product team so they are aware of the demand.

Best regards