Updating expiration date of key vault secrets using terraform

Question

I am trying to update the expiration date of all the secrets available in the Key Vault. I have written below terraform script and kind of stuck at a point.

main.tf file

data "azurerm_key_vault" "key_vault_data" {
   name = var.name
   resource_group_name = var.resource_group_name
}

resource "azurerm_key_vault_secret" "all_secrets" {
   for_each = data.azurerm_key_vault.key_vault_data.secrets
   name = each.value.name
   value = each.value.value
   key_vault_id = data.azurerm_key_vault.key_vault_data.id
   expiration_date = timestamp() + var.days_to_expire * 24 *60 *60
}

variable.tf file

variable "name" {
default = "KV-***" # name of the key vault
}

variable "resource_group_name" {
  default = "RG-***" # name of the resource group
}

variable "days_to_expire" {
   type = number
   default = 730
}

Below is the error I am getting when I run the terraform script

Error: Unsupported attribute on .terraform/modules/key_vault/main.tf
line 130, in resource "azurerm_key_vault_secret" "all_secrets":
 
130:for_each = data.azurerm_key_vault.key_vault_data.secrets this object
has no argument, nested block, or exported attribute name "secrets".

Answer 1

First thing, your secrets would need to be imported in the terraform state in order to do so.

I'm using some other data sources to get the list of secrets and certificates.
Key vault certs are also stored as base64 encoded secrets so we need to remove them from the secret list in order to only update secrets.

Here is my terraform file:

terraform {
  required_version = ">= 1.3.0"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 3.42.0"
    }
  }
}

provider "azurerm" {
   features {}
}

// get a reference to key vault
data "azurerm_key_vault" "this" {
  name                = var.key_vault_name
  resource_group_name = var.resource_group_name
}

// get a reference to key vault certificates
data "azurerm_key_vault_certificates" "this" {
  key_vault_id = data.azurerm_key_vault.this.id
}

// get a reference to key vault secrets
data "azurerm_key_vault_secrets" "this" {
  key_vault_id = data.azurerm_key_vault.this.id
}

locals {
  // we remove the certificates from the secrets list
  only_secrets = setsubtract(data.azurerm_key_vault_secrets.this.names, data.azurerm_key_vault_certificates.this.names)
  // we're using timeadd and we can't pass the day directly need to be hours
  days_to_hours = var.days_to_expire * 24
  // expiration date need to be in a specific format as well
  expiration_date = timeadd(formatdate("YYYY-MM-DD'T'HH:mm:ssZ", timestamp()), "${local.days_to_hours}h")
}

// Now we can get a reference of the existing secrets
data "azurerm_key_vault_secret" "existing" {
  for_each     = toset(local.only_secrets)
  name         = each.key
  key_vault_id = data.azurerm_key_vault.this.id
}

// Just need to update the secrets now
resource "azurerm_key_vault_secret" "to_update" {
  for_each        = toset(local.only_secrets)
  key_vault_id    = data.azurerm_key_vault.this.id
  name            = each.key
  value           = data.azurerm_key_vault_secret.existing[each.key].value
  expiration_date = local.expiration_date
}