Terraform中vault_generic_secret的data_json赋值失败求助

问题场景 #

使用Terraform向Vault写入密钥时，vault_generic_secret资源的data_json属性赋值报错，错误信息如下：

Error: Incorrect attribute value type

on main.tf line 173, in resource "vault_generic_secret" "example":
173: data_json = var.secret

Inappropriate value for attribute "data_json": string required.

当前相关配置：

• main.tf资源定义：

provider "vault" {
  address = "https://secrets.staging.hulu.com"

  auth_login {
    path      = "auth/aws/login"
    method    = "aws"
    namespace = var.vault_namespace
    parameters = {
      role         = "service-${var.yp_service_id}-tfe"
      header_value = var.header_value
      sts_region   = local.region
    }
  }
}

resource "vault_generic_secret" "example" {
  path      = "kv/${var.yp_service_id}/secret"
  data_json = var.secret
}

data vault_generic_secret example {
  depends_on = [vault_generic_secret.example]
  path      = "kv/${var.yp_service_id}/secret"
}

• variables.tf变量声明：

variable "address" {
  type        = string
  description = "vault address"
  default     = "https://secrets.staging.dummy.com"
}

variable "vault_namespace" {
  type        = string
  description = "vault namespace"
  default     = "5f8dd98fc08eda598857b651"
}

variable "header_value" {
  type        = string
  description = "vault header"
  default     = "secrets.staging.dummy.com"
}

variable "secret" {
  description = "Sensitive secrets for the service"
  type        = map(string)
  sensitive   = true
}

variable "data_json" {
  description = "Sensitive secrets for the service"
  type        = map(any)
  sensitive   = true
  default     = {}
}

错误原因 #

vault_generic_secret的data_json属性要求传入JSON格式的字符串，但当前直接传入了map(string)类型的var.secret，类型不匹配导致报错。

解决方案 #

1. 用jsonencode()转换变量类型 #

修改main.tf中的vault_generic_secret资源，使用Terraform内置的jsonencode()函数将map类型转换为符合要求的JSON字符串：

resource "vault_generic_secret" "example" {
  path      = "kv/${var.yp_service_id}/secret"
  data_json = jsonencode(var.secret) # 转换map为JSON字符串
}

2. 清理冗余变量 #

variables.tf中的data_json变量未被实际使用，可直接移除以避免混淆：

# 移除以下冗余配置
# variable "data_json" {
#   description = "Sensitive secrets for the service"
#   type        = map(any)
#   sensitive   = true
#   default     = {}
# }

3. 正确传入变量值 #

在.tfvars文件或环境变量中，按map(string)格式传入密钥数据：

secret = {
  DD_API_KEY = "*****************"
  DD_APP_KEY = "*****************"
  DD_SITE    = "datadoghq.com"
}

验证 #

修改后执行terraform plan，类型不匹配的错误会消失，Terraform会将转换后的JSON字符串写入Vault指定路径。

内容的提问来源于stack exchange，提问作者Aravind S