kovagoadi/hunfabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Create random passwords only when needed, use write-only attribute for passwords

Browse Source
This commit is contained in:
Wiktor Niesiobędzki
2025-06-05 11:21:57 +00:00
committed by Wiktor Niesiobędzki
parent e6ec5de733
commit aecc4d53b9
4 changed files with 19 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
modules/cloudsql-instance/README.md
View File

@@ -438,7 +438,7 @@ module "db" {
| [ssl](variables.tf#L265) | Setting to enable SSL, set config and certificates. | <code title="object&#40;&#123;&#10; client_certificates &#61; optional&#40;list&#40;string&#41;&#41;&#10; mode &#61; optional&#40;string&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>&#123;&#125;</code> |
| [terraform_deletion_protection](variables.tf#L280) | Prevent terraform from deleting instances. | <code>bool</code> | | <code>true</code> |
| [time_zone](variables.tf#L292) | The time_zone to be used by the database engine (supported only for SQL Server), in SQL Server timezone format. | <code>string</code> | | <code>null</code> |
| [users](variables.tf#L298) | Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything after the first `@` (if present) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'. | <code title="map&#40;object&#40;&#123;&#10; password &#61; optional&#40;string&#41;&#10; type &#61; optional&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>null</code> |
| [users](variables.tf#L298) | Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything after the first `@` (if present) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'. | <code title="map&#40;object&#40;&#123;&#10; password &#61; optional&#40;string&#41;&#10; password_version &#61; optional&#40;number&#41;&#10; type &#61; optional&#40;string, &#34;BUILT_IN&#34;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
## Outputs

18
modules/cloudsql-instance/main.tf
View File

@@ -21,19 +21,19 @@ locals {
has_replicas = length(var.replicas) > 0
is_regional = var.availability_type == "REGIONAL" ? true : false
users = {
for k, v in coalesce(var.users, {}) : k =>
for k, v in var.users : k =>
local.is_mysql
? {
name = coalesce(v.type, "BUILT_IN") == "BUILT_IN" ? split("@", k)[0] : k
host = coalesce(v.type, "BUILT_IN") == "BUILT_IN" ? try(split("@", k)[1], null) : null
password = coalesce(v.type, "BUILT_IN") == "BUILT_IN" ? try(random_password.passwords[k].result, v.password) : null
type = coalesce(v.type, "BUILT_IN")
name = v.type == "BUILT_IN" ? split("@", k)[0] : k
host = v.type == "BUILT_IN" ? try(split("@", k)[1], null) : null
password = v.type == "BUILT_IN" ? try(random_password.passwords[k].result, v.password) : null
type = v.type
}
: {
name = local.is_postgres ? try(trimsuffix(k, ".gserviceaccount.com"), k) : k
host = null
password = coalesce(v.type, "BUILT_IN") == "BUILT_IN" ? try(random_password.passwords[k].result, v.password) : null
type = coalesce(v.type, "BUILT_IN")
password = v.type == "BUILT_IN" ? try(random_password.passwords[k].result, v.password) : null
type = v.type
}
}
}
@@ -285,9 +285,9 @@ resource "google_sql_database" "databases" {
resource "random_password" "passwords" {
for_each = toset([
for k, v in coalesce(var.users, {}) :
for k, v in var.users :
k
if v.password == null
if v.password == null && v.type == "BUILT_IN"
])
length = try(var.password_validation_policy.min_length, 16)
special = true

6
modules/cloudsql-instance/outputs.tf
View File

@@ -127,8 +127,10 @@ output "self_links" {
output "user_passwords" {
description = "Map of containing the password of all users created through terraform."
value = {
for name, user in google_sql_user.users :
name => user.password
for k, v in local.users : k => v.password
}
sensitive = true
depends_on = [
google_sql_user.users
]
}

8
modules/cloudsql-instance/variables.tf
View File

@@ -298,8 +298,10 @@ variable "time_zone" {
variable "users" {
description = "Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything after the first `@` (if present) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'."
type = map(object({
password = optional(string)
type = optional(string)
password = optional(string)
password_version = optional(number)
type = optional(string, "BUILT_IN")
}))
default = null
default = {}
nullable = false
}