Fixed incorrect secret creation on drift detection of secret value

[jorgecarleitao]

Resolves #1383
Resolves #2288

---

Before the change?

Given a .tf with a resource with any secret
When .tf is applied
And the secret's value is externally modified
And .tf is applied
Then the new plan results in the creation of a new secret

After the change?

Given a .tf with a resource with any secret
When .tf is applied
And the secret's value is externally modified
And .tf is applied
Then the plan results in the update of the existing secret

In particular, this behavior enables the use of the lifecycle meta argument to ignore changes to externally updated secrets.

Pull request checklist

• Tests for the changes have been added (for bug fixes / features)
• Docs have been reviewed and added / updated if needed (for bug fixes / features)

NOTE: I could not find any test that I could re-use to introduce an external change to an existing resource. Need support.

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

• Yes
• No

---

[nbali]

yeah, pretty much what I had in mind, ty for your time

[mothilraj]

Please let us know when this fix will be merged.

[dcfsc]

This issue is making me reconsider the use of Terraform to manage repository secrets, or split secrets into a new configuration.

We create a placeholder secret and ignore the changes, so the team can update the secrets and we will not detect a drift.
Every plan now shows dirty if the value is changed, and if I apply without a target, it replaces the new desired value with the placeholder value. So I have to warn teams NOT to apply when secrets are changed. In most cases the secret comes from somewhere else, but that is additional work AND the plan is now dirty AGAIN.
I will probably grab the code for the latest provider and try to make a patched version for myself. Would love if we could merge this.

[dcfsc]

I built the latest version of the provider and cherry picked your 1 commit on the "fix" branch. It works like a dream.

[jacobkretz-bf]

@nbali This is a really big issue. Any ETA.

[nbali]

@jacobkretz-bf I'm not sure why are you mentioning me :) I just suggested a solution to the issue, that @jorgecarleitao essentially implemented.

[grobbinsBF]

@kfcampbell What does it take to get this PR approved and released?