Skip to content

apikeys: add ephemeral variant for fetching google_api_keys_key#18226

Open
ramonvermeulen wants to merge 1 commit into
GoogleCloudPlatform:mainfrom
ramonvermeulen:f/28235-ephemeral-google-apikeys-key
Open

apikeys: add ephemeral variant for fetching google_api_keys_key#18226
ramonvermeulen wants to merge 1 commit into
GoogleCloudPlatform:mainfrom
ramonvermeulen:f/28235-ephemeral-google-apikeys-key

Conversation

@ramonvermeulen

@ramonvermeulen ramonvermeulen commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Closes hashicorp/terraform-provider-google#28235
Closes hashicorp/terraform-provider-google#22187

Adds an ephemeral variant to fetch a google_api_keys_key so that the API key can be used in combination with for example a write-only argument on the google_secret_manager_secret_version.

apikeys: add ephemeral variant for fetching `google_api_keys_key`

Sample usage:

### Creates the key
resource "google_apikeys_key" "primary" {
  name         = "my-key"
  display_name = "sample-key"
}

### Fetches the key "securely"
ephemeral "google_apikeys_key" "primary" {
  name = google_apikeys_key.primary.id
}

### Places the key as write-only argument so not exposing to tfstate
resource "google_secret_manager_secret_version" "api_key" {
  secret                 = google_secret_manager_secret.api_key.id
  secret_data_wo         = ephemeral.google_apikeys_key.primary.key_string
  secret_data_wo_version = "1"
}

Local tests:

╰─❯ make testacc TEST=./google/services/apikeys TESTARGS='-run=TestAccEphemeralApikeysKey_'
sh -c "'/Users/ramon/go/src/github.com/hashicorp/terraform-provider-google/scripts/gofmtcheck.sh'"
==> Checking that code complies with gofmt requirements...
go vet
TF_ACC_REFRESH_AFTER_APPLY=1 TF_ACC=1 TF_SCHEMA_PANIC_ON_ERROR=1 go test ./google/services/apikeys -v -run=TestAccEphemeralApikeysKey_ -timeout 240m -ldflags="-X=github.com/hashicorp/terraform-provider-google/version.ProviderVersion=acc"
=== RUN   TestAccEphemeralApikeysKey_basic
=== PAUSE TestAccEphemeralApikeysKey_basic
=== CONT  TestAccEphemeralApikeysKey_basic
--- PASS: TestAccEphemeralApikeysKey_basic (27.92s)
PASS
ok      github.com/hashicorp/terraform-provider-google/google/services/apikeys  28.906s

@modular-magician modular-magician added the awaiting-approval Pull requests that need reviewer's approval to run presubmit tests label Jul 8, 2026
@github-actions github-actions Bot requested a review from rileykarson July 8, 2026 14:20
@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@rileykarson, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

awaiting-approval Pull requests that need reviewer's approval to run presubmit tests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

New Ephemeral Resource: google_apikeys_key Ephemeral resource for google_apikeys_key

2 participants