bugfix - #4789 AWS Secrets Manager - retrieve json secret as a map

[ozbillwang]

Fixes #4789

Changes proposed in this pull request:

• AWS Secrets Manager - retrieve json secret as a map (original it is string)

Tasks:

• bugfix
• test case
• document updates.

Output from acceptance testing:

$ make testacc TESTARGS='-run=TestAccAWSAvailabilityZones'

...

Here is my test code

provider "aws" {
  region = "ap-southeast-2"
}

variable "secret" {
  type = "map"
  default = {
    name = "team_project_dev"
    key = "db_master_password"
  }
}

data "aws_secretsmanager_secret" "secret" {
  name = "${lookup(var.secret, "name")}"
}

data "aws_secretsmanager_secret_version" "secret" {
  secret_id = "${data.aws_secretsmanager_secret.secret.id}"
}

locals {
  master_password = "${lookup(data.aws_secretsmanager_secret_version.secret.secret_string, lookup(var.secret, "key"))}"
}

output "master_password" {
  value = "${local.master_password}"
}

Result:

$ terraform apply 

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

master_password = test

[bflad]

Hi @ozbillwang 👋 Thanks for submitting this. In addition to the below items, which might would prevent us from accepting this pull request, we may opt to not create a second attribute at all.

The next major version of Terraform should support jsondecode() as a built-in function, removing the necessity of needing a separate attribute to break apart the JSON (when it is JSON).

[bflad]

Changing an attribute type is a breaking change for existing Terraform configurations. This new behavior should be handled by creating a new attribute and a new acceptance test added to cover if and when this new attribute is available.

There are also other potential issues with introducing this second attribute as briefly outlined in: #4613 (comment)

[bflad]

It is valid to create a Secrets Manager secret that is a single string value (not JSON). This error should only be logged to not break handling with those types of secrets.

[bflad]

I provided additional information about this handling in #4789 (comment)

[ozbillwang]

@bflad

Thanks for reviewing, this PR is not suitable, I will close it and wait for new v0.12 release.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!