Resource update and delete support

[daankragt]

Hi,

We use KeyHub extensively and would love to manage its configuration through Terraform instead of the manual click-ops process we currently use. The absence of update and delete support for resources looks to be a dealbreaker for us right now since it's very easy to get into a situation where the Terraform state no longer matches the actual state of the KeyHub appliance. Without the ability of the Terraform KeyHub provider to rectify these drift scenarios we still need manual intervention. In short, my question is as follows: Is there a technical reason/issue why there's no update and delete support in the provider or is it just something Topicus hasn't gotten around to yet? If it's the latter, we might look into writing this code for at least the group and grouponsystem resources.

Thanks in advance, keep up the good work.

Daan Kragt

[papegaaij]

Hi @daankragt ,

The Terraform provider supports update and delete for those resources that can be updated or deleted via the API by an OAuth2 client. The permission model of Topicus KeyHub prohibits clients from updating some types of objects, like clients, groups on systems and groups in KeyHub itself. These resources can therefore only be created via Terraform. Other resources, like vault records, can be updated and deleted.

Specifically for groups and grouponsystem resources, these are sensitive security objects that we cannot have automation modify. Allowing an OAuth2 client to modify these objects would break our security model. For groups it is totally impossible, because the client does not own the keys to modify a group. Only the managers of a group has those keys. Grouponsystem is basically read-only in KeyHub, once it has been created. Allowing changes to a group on system, could allow a client to re-arrange permissions without proper approval of the owner of the group on system.

Best regards,
Emond

[daankragt]

Hi Emond,

Ok, makes sense. It does however create an odd situation when you create a group and group_on_system through Terraform and one or both resources drift from the Terraform state. In that case Terraform will detect that the resources are not configured as they should be, yet Terraform can't correct it (since update and delete are missing from the provider). This creates a failing Terraform template (and pipeline) which can't be fixed without either deleting the resources through KeyHub (so they can be recreated) or editing the Terraform state by hand. This makes it fairly difficult (if not impossible) to deploy KeyHub resources as Infrastructure as Code. Are there options/possibilities I'm missing or is this how it is?

Thanks,

Daan