kovagoadi/hunfabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Create random passwords only when needed, use write-only attribute for passwords

Browse Source
This commit is contained in:
Wiktor Niesiobędzki
2025-06-05 11:21:57 +00:00
committed by Wiktor Niesiobędzki
parent e6ec5de733
commit aecc4d53b9
4 changed files with 19 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
modules/cloudsql-instance/main.tf
View File

@@ -21,19 +21,19 @@ locals {
has_replicas = length(var.replicas) > 0
is_regional = var.availability_type == "REGIONAL" ? true : false
users = {
for k, v in coalesce(var.users, {}) : k =>
for k, v in var.users : k =>
local.is_mysql
? {
name = coalesce(v.type, "BUILT_IN") == "BUILT_IN" ? split("@", k)[0] : k
host = coalesce(v.type, "BUILT_IN") == "BUILT_IN" ? try(split("@", k)[1], null) : null
password = coalesce(v.type, "BUILT_IN") == "BUILT_IN" ? try(random_password.passwords[k].result, v.password) : null
type = coalesce(v.type, "BUILT_IN")
name = v.type == "BUILT_IN" ? split("@", k)[0] : k
host = v.type == "BUILT_IN" ? try(split("@", k)[1], null) : null
password = v.type == "BUILT_IN" ? try(random_password.passwords[k].result, v.password) : null
type = v.type
}
: {
name = local.is_postgres ? try(trimsuffix(k, ".gserviceaccount.com"), k) : k
host = null
password = coalesce(v.type, "BUILT_IN") == "BUILT_IN" ? try(random_password.passwords[k].result, v.password) : null
type = coalesce(v.type, "BUILT_IN")
password = v.type == "BUILT_IN" ? try(random_password.passwords[k].result, v.password) : null
type = v.type
}
}
}
@@ -285,9 +285,9 @@ resource "google_sql_database" "databases" {
resource "random_password" "passwords" {
for_each = toset([
for k, v in coalesce(var.users, {}) :
for k, v in var.users :
k
if v.password == null
if v.password == null && v.type == "BUILT_IN"
])
length = try(var.password_validation_policy.min_length, 16)
special = true