Support for set and get activation and expiration date on azurerm_key_vault_secret

[Tomaswe]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

The secrets can have activation and expiration date (datetime) set via Azure Portal or CLI.
Lacking the ability to set expiration date on the resource makes this security measure a manual task with the risk of forgetting and leaving the secrets valid forever.

New or Affected Resource(s)

• azurerm_key_vault_secret

Potential Terraform Configuration

resource "azurerm_key_vault_secret" "expiring_secret" {
  name = "my-secret"
  value = "hush"
  key_vault_id = var.key_vault_id
  set_activation_date = false
  set_expiration_date = true
  expiration_date = "2020-01-01T12:00:00Z"
}

Today, while setting the expiration date manually, also setting a timestamp in a tag is the best way I've found to provide the expiration information to applications configuration during terraforming.
But that is manually synchronized and error prone or relying on some external scripting.

resource "azurerm_key_vault_secret" "expiring_secret" {
  name = "my-secret"
  value = "hush"
  key_vault_id = var.key_vault_id
  tags = {
    expires = var.expire_date
  }
}

and then to retrieve it

data "azurerm_key_vault_secret" "expiring_secret" {
  name = "my-secret"
  key_vault_id = var.key_vault_id
}
output "secret_expires"{
  value = data.azurerm_key_vault_secret.expiring_secret.tags["expires"]
}

References

• https://docs.microsoft.com/en-us/cli/azure/keyvault/secret?view=azure-cli-latest#az-keyvault-secret-set
• https://docs.microsoft.com/en-us/cli/azure/keyvault/secret?view=azure-cli-latest#az-keyvault-secret-set-attributes

[aqche]

Made an attempt at adding the not_before_date and expiration_date options to the azurerm_key_vault_secret in this PR!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!