@@ -42,6 +42,14 @@ type Model struct {
4242 ProjectId types.String `tfsdk:"project_id"`
4343 Name types.String `tfsdk:"name"`
4444 ACLs types.Set `tfsdk:"acls"`
45+ KmsKey * KmsKeyModel `tfsdk:"kms_key"`
46+ }
47+
48+ type KmsKeyModel struct {
49+ KeyId types.String `tfsdk:"key_id"`
50+ KeyRingId types.String `tfsdk:"key_ring_id"`
51+ KeyVersion types.Int64 `tfsdk:"key_version"`
52+ ServiceAccountEmail types.String `tfsdk:"service_account_email"`
4553}
4654
4755// NewInstanceResource is a helper function to simplify the provider implementation.
@@ -77,12 +85,17 @@ func (r *instanceResource) Configure(ctx context.Context, req resource.Configure
7785// Schema defines the schema for the resource.
7886func (r * instanceResource ) Schema (_ context.Context , _ resource.SchemaRequest , resp * resource.SchemaResponse ) {
7987 descriptions := map [string ]string {
80- "main" : "Secrets Manager instance resource schema. Must have a `region` specified in the provider configuration." ,
81- "id" : "Terraform's internal resource ID. It is structured as \" `project_id`,`instance_id`\" ." ,
82- "instance_id" : "ID of the Secrets Manager instance." ,
83- "project_id" : "STACKIT project ID to which the instance is associated." ,
84- "name" : "Instance name." ,
85- "acls" : "The access control list for this instance. Each entry is an IP or IP range that is permitted to access, in CIDR notation" ,
88+ "main" : "Secrets Manager instance resource schema. Must have a `region` specified in the provider configuration." ,
89+ "id" : "Terraform's internal resource ID. It is structured as \" `project_id`,`instance_id`\" ." ,
90+ "instance_id" : "ID of the Secrets Manager instance." ,
91+ "project_id" : "STACKIT project ID to which the instance is associated." ,
92+ "name" : "Instance name." ,
93+ "acls" : "The access control list for this instance. Each entry is an IP or IP range that is permitted to access, in CIDR notation" ,
94+ "kms_key" : "The STACKIT-KMS key for secret encryption and decryption." ,
95+ "kms_key.key_id" : "UUID of the key within the STACKIT-KMS to use for the encryption." ,
96+ "kms_key.key_ring_id" : "UUID of the keyring where the key is located within the STACKTI-KMS." ,
97+ "kms_key.key_version" : "Version of the key within the STACKIT-KMS to use for the encryption." ,
98+ "kms_key.service_account_email" : "Service-Account linked to the Key within the STACKIT-KMS." ,
8699 }
87100
88101 resp .Schema = schema.Schema {
@@ -118,11 +131,9 @@ func (r *instanceResource) Schema(_ context.Context, _ resource.SchemaRequest, r
118131 },
119132 },
120133 "name" : schema.StringAttribute {
121- Description : descriptions ["name" ],
122- Required : true ,
123- PlanModifiers : []planmodifier.String {
124- stringplanmodifier .RequiresReplace (),
125- },
134+ Description : descriptions ["name" ],
135+ Required : true ,
136+ PlanModifiers : []planmodifier.String {},
126137 Validators : []validator.String {
127138 stringvalidator .LengthAtLeast (1 ),
128139 },
@@ -137,6 +148,28 @@ func (r *instanceResource) Schema(_ context.Context, _ resource.SchemaRequest, r
137148 ),
138149 },
139150 },
151+ "kms_key" : schema.SingleNestedAttribute {
152+ Description : descriptions ["kms_key" ],
153+ Optional : true ,
154+ Attributes : map [string ]schema.Attribute {
155+ "key_id" : schema.StringAttribute {
156+ Description : descriptions ["kms_key.key_id" ],
157+ Required : true ,
158+ },
159+ "key_ring_id" : schema.StringAttribute {
160+ Description : descriptions ["kms_key.key_ring_id" ],
161+ Required : true ,
162+ },
163+ "key_version" : schema.Int64Attribute {
164+ Description : descriptions ["kms_key.key_version" ],
165+ Required : true ,
166+ },
167+ "service_account_email" : schema.StringAttribute {
168+ Description : descriptions ["kms_key.service_account_email" ],
169+ Required : true ,
170+ },
171+ },
172+ },
140173 },
141174 }
142175}
@@ -284,6 +317,21 @@ func (r *instanceResource) Update(ctx context.Context, req resource.UpdateReques
284317 ctx = tflog .SetField (ctx , "project_id" , projectId )
285318 ctx = tflog .SetField (ctx , "instance_id" , instanceId )
286319
320+ // Generate API request body from model
321+ payload , err := toUpdatePayload (& model )
322+ if err != nil {
323+ core .LogAndAddError (ctx , & resp .Diagnostics , "Error updating instance" , fmt .Sprintf ("Creating API payload: %v" , err ))
324+ return
325+ }
326+ // Update instance
327+ err = r .client .UpdateInstance (ctx , projectId , instanceId ).UpdateInstancePayload (* payload ).Execute ()
328+ if err != nil {
329+ core .LogAndAddError (ctx , & resp .Diagnostics , "Error updating instance" , fmt .Sprintf ("Calling API: %v" , err ))
330+ return
331+ }
332+
333+ ctx = core .LogResponse (ctx )
334+
287335 var acls []string
288336 if ! (model .ACLs .IsNull () || model .ACLs .IsUnknown ()) {
289337 diags = model .ACLs .ElementsAs (ctx , & acls , false )
@@ -294,15 +342,15 @@ func (r *instanceResource) Update(ctx context.Context, req resource.UpdateReques
294342 }
295343
296344 // Update ACLs
297- err : =updateACLs (ctx , projectId , instanceId , acls , r .client )
345+ err = updateACLs (ctx , projectId , instanceId , acls , r .client )
298346 if err != nil {
299347 core .LogAndAddError (ctx , & resp .Diagnostics , "Error updating instance" , fmt .Sprintf ("Updating ACLs: %v" , err ))
300348 return
301349 }
302350
303351 instanceResp , err := r .client .GetInstance (ctx , projectId , instanceId ).Execute ()
304352 if err != nil {
305- core .LogAndAddError (ctx , & resp .Diagnostics , "Error updating instance" , fmt .Sprintf ("Calling API: %v" , err ))
353+ core .LogAndAddError (ctx , & resp .Diagnostics , "Error updating instance acl " , fmt .Sprintf ("Calling API: %v" , err ))
306354 return
307355 }
308356
@@ -398,6 +446,15 @@ func mapFields(instance *secretsmanager.Instance, aclList *secretsmanager.ListAC
398446 model .InstanceId = types .StringValue (instanceId )
399447 model .Name = types .StringPointerValue (instance .Name )
400448
449+ if instance .KmsKey != nil {
450+ model .KmsKey = & KmsKeyModel {
451+ KeyId : types .StringPointerValue (instance .KmsKey .KeyId ),
452+ KeyRingId : types .StringPointerValue (instance .KmsKey .KeyRingId ),
453+ KeyVersion : types .Int64PointerValue (instance .KmsKey .KeyVersion ),
454+ ServiceAccountEmail : types .StringPointerValue (instance .KmsKey .ServiceAccountEmail ),
455+ }
456+ }
457+
401458 err := mapACLs (aclList , model )
402459 if err != nil {
403460 return err
@@ -431,9 +488,41 @@ func toCreatePayload(model *Model) (*secretsmanager.CreateInstancePayload, error
431488 if model == nil {
432489 return nil , fmt .Errorf ("nil model" )
433490 }
434- return & secretsmanager.CreateInstancePayload {
491+ payload := & secretsmanager.CreateInstancePayload {
435492 Name : conversion .StringValueToPointer (model .Name ),
436- }, nil
493+ }
494+
495+ if model .KmsKey != nil {
496+ payload .KmsKey = & secretsmanager.KmsKeyPayload {
497+ KeyId : conversion .StringValueToPointer (model .KmsKey .KeyId ),
498+ KeyRingId : conversion .StringValueToPointer (model .KmsKey .KeyRingId ),
499+ KeyVersion : conversion .Int64ValueToPointer (model .KmsKey .KeyVersion ),
500+ ServiceAccountEmail : conversion .StringValueToPointer (model .KmsKey .ServiceAccountEmail ),
501+ }
502+ }
503+
504+ return payload , nil
505+ }
506+
507+ func toUpdatePayload (model * Model ) (* secretsmanager.UpdateInstancePayload , error ) {
508+ if model == nil {
509+ return nil , fmt .Errorf ("nil model" )
510+ }
511+
512+ payload := & secretsmanager.UpdateInstancePayload {
513+ Name : conversion .StringValueToPointer (model .Name ),
514+ }
515+
516+ if model .KmsKey != nil {
517+ payload .KmsKey = & secretsmanager.KmsKeyPayload {
518+ KeyId : conversion .StringValueToPointer (model .KmsKey .KeyId ),
519+ KeyRingId : conversion .StringValueToPointer (model .KmsKey .KeyRingId ),
520+ KeyVersion : conversion .Int64ValueToPointer (model .KmsKey .KeyVersion ),
521+ ServiceAccountEmail : conversion .StringValueToPointer (model .KmsKey .ServiceAccountEmail ),
522+ }
523+ }
524+
525+ return payload , nil
437526}
438527
439528// updateACLs creates and deletes ACLs so that the instance's ACLs are the ones in the model
0 commit comments