Open
Description
Problem:
In https://github.com/terraform-ibm-modules/terraform-ibm-observability-instances/blob/main/modules/cloud_monitoring/main.tf a resource key is always created. Consumers are reporting it is hard to follow secret rotation best practises because:
- 1 key is always created - even if its not needed
- You currently cannot rotate the key value using terraform. Simply changing the value of
manager_key_name
will not rotate the key. - You really need the ability to have 2 active keys at any given time to be able to rotate key consumers (e.g. sysdig agents) non disruptively
Proposal:
- Remove the
manager_key_name
input and replace it with a new inputresource_keys
(copy this approach)
Considerations:
- Should the default value of
resource_keys
be a way where it will create the manager key by default? Or it should create no key by default? - This will be a breaking change that will impact consumers. How should we handle?