ephemeral/password: Introduce a new ephemeral password resource

[austinvalle]

This PR is currently in draft as an ephemeral random password is not particularly useful until managed resources are updated to allow interaction with ephemeral data (via write-only attributes, earliest that will be available is Terraform v1.11.0)

Closes #639

This PR introduces a new random_password ephemeral resource which is functionally similar to the managed resource, minus the keepers and id attributes. Once write-only attribute are introduced in Terraform v1.11, this resource can be used to generate a random password while avoiding storing that password in state.

Notes

• keepers are not relevant because ephemeral resources do not produce a plan and are never stored in state. Triggers for producing an ephemeral password will eventually be the responsibility of the module author.
• id is not relevant because the new testing framework doesn't require this information and the practitioner doesn't benefit from the duplication with result.

[ktham]

Ultimately, it will be up to the consuming managed resource implementation (for example, an aws_db_instance) to define when the write-only attribute will be consumed, which likely will need to be a separate non-write-only attribute to allow the practitioner to explicitly indicate they want the provider to use the write-only value.

Got it, thank you for explaining :) - aws_db_instance is precisely one of the resources that I'm waiting for a potential implementation of write-only attribute for the password field, and regarding tracking the change of a non-writeonly value to consume the write-only makes sense, thank you for the example, we'll wait for the final version of the implementation and will be eager to start using it. Thanks!

(edit: woops, sorry, I meant to reply in the thread above)

[bbasata]

[sov-msaeed]

@austinvalle sorry to comment on closed pull request, First of all thank you so much for this great feature. can't wait to try it out.

I am using random_password along with aws_secretsmanager_secret_version to create passwords and save them in secrets manager. with this pull request i can achieve one step of the goal but with aws_secretsmanager_secret_version the secret is still written to the state file. I have create this issue hashicorp/terraform-provider-aws#41457 but I wanted to ask if this something will be handled actually by default in the new terraform 1.11 version or an ephemeral resource would need to be created as well for aws_secretsmanager_secret_version similar to random_password ?

Thanks again