oci_vault_secret - Automatic secret generation

[martysweet]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

The vault secrets API now offers the capability to generate specific types of secrets such as:

• SSH
• Passphrase
• Bytes

This can be seen in the following resources:

• https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Tasks/managingsecrets_topic-To_create_a_new_secret.htm (see CLI)
• https://blogs.oracle.com/cloud-infrastructure/post/automate-secret-generation-oci-secret-management

New or Affected Resource(s)

oci_vault_secret

Potential Terraform Configuration

The resource should be expanded to support the secret-generation-context, which requires the fields such as

{
	"generation_type": "PASSPHRASE",
	"generation_template": "DBAAS_DEFAULT_PASSWORD",
	"secret_template": {
		"username": "ORACLE",
		"password": "%GENERATED_PASSPHRASE%"
	}	
}

This should be possible to align with the existing rotation context, and would require some conditions around when a generation context is permitted vs. a statically assigned secret.

It should then be possible to pull the secret back into Terraform and use it within the same Terraform execution.

Thanks!