olivr / terraform-provider-gpg

Terraform provider to generate a PGP key pair just like GPG would 🔐

GPG Terraform Provider

Terraform provider to generate a PGP key pair just like GPG would 🔐. Using GopenPGP under the hood.

Using the provider

View the documentation on Terraform registry or in the docs folder

terraform {
  required_providers {
    gpg = {
      source = "Olivr/gpg"
    }
  }
}

resource "gpg_private_key" "key" {
    name = "John Doe"
    email = "[email protected]"
}

Contributing

If you wish to work on the provider, you'll need:

• Terraform >= 1.0.x
• Go >= 1.17

To compile the provider, run make. This will build the provider and put the provider binary in the $GOPATH/bin directory.

Add the local build to your local Terraform plugins so you can test it in your project context.

mkdir -p ~/.terraform.d/plugins/registry.terraform.io/Olivr/gpg/0.0.1/$(go env GOOS)_$(go env GOARCH)
ln -s $(go env GOPATH)/bin/terraform-provider-gpg ~/.terraform.d/plugins/registry.terraform.io/Olivr/gpg/0.0.1/$(go env GOOS)_$(go env GOARCH)/terraform-provider-gpg

In order to run the full suite of Acceptance tests, run make test.

To generate or update documentation, run make doc.

Maintaining

To release, just push a new tag respecting Semver:

VERSION=v0.1.0
git tag $VERSION main
git push origin $VERSION

terraform-provider-gpg's Issues

Error Decrypting Files in AWS Transfer Decrypt Workflow

Hi there,

Thank you for opening an issue. Please note that we try to keep the Terraform issue tracker reserved for bug reports and feature requests. For general usage questions, please see: https://www.terraform.io/community.html.

Terraform Version

1.5.7

Affected Resource(s)

Please list the resources as a list, for example:

• gpg_private_key

If this issue appears to affect multiple resources, it may be an issue with Terraform's core, so please mention this.

Terraform Configuration Files

resource "aws_secretsmanager_secret_version" "this" {
  secret_id = aws_secretsmanager_secret.this.id
  secret_string = jsonencode(
    {
      PGPPrivateKey = gpg_private_key.this.private_key
      PGPPassphrase = gpg_private_key.this.passphrase
    }
  )
}

Debug Output

{
    "type": "StepErrored",
    "details": {
        "errorType": "BAD_REQUEST",
        "errorMessage": "Encryption algorithm not found in preferred algorithms specified by key. Encryption algorithm used: CAST5. Preferred algorithms specified by key: [AES-256, AES-128].",
        "stepType": "DECRYPT",
        "stepName": "Decrypt"
    }
}

Actual Behavior

What actually happened?
We are using the gpg provider to generate a gpg key and passphrase and following the aws guide to create a decrypt workflow but we are receiving the following error: "Encryption algorithm not found in preferred algorithms specified by key. Encryption algorithm used: CAST5. Preferred algorithms specified by key: [AES-256, AES-128]."

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform apply

References

• https://aws.amazon.com/blogs/storage/encrypt-and-decrypt-files-with-pgp-and-aws-transfer-family/

Support dearmored output

Presently the gpg_private_key resource supports only ASCII-armored output, however my system needs the binary output. The only way to achieve this right now is to write the file out and run a gpg --dearmor command against it, which is not great. Can the resource be extended with a base64 encoded private and public key?

Add build for darwin_arm64

Hi there,

Terraform Version

1.1.5

Affected Resource(s)

Please list the resources as a list, for example:

• gpg_private_key

Debug Output

Error: Incompatible provider version
 
Provider registry.terraform.io/olivr/gpg v0.2.0 does not have a package available for your current platform, darwin_arm64.

Provider releases are separate from Terraform CLI releases, so not all providers are available for all platforms. Other versions of this provider may have different platforms supported.