Add deletion_protection argument to google_secret_manager_secret

[Revyy]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

The accidental deletion of secret manager secrets can be very disruptive if the secret is used by a production service.
Terraforms lifecycle { prevent_destroy=true } solves this issue in a blunt way but it is not really useable if you use terraform modules to provide a unified way of creating secrets across the organisation.

It would be very useful to have an option to set the deletion_protection argument for google_secret_manager_secret similarly to how you can do it for the google_sql_database_instance resource. This would allow us to prevent accidental deletions while still providing a good developer experience with terraform modules.

New or Affected Resource(s)

• google_secret_manager_secret

Potential Terraform Configuration

resource "google_secret_manager_secret" "secret-basic" {
  secret_id = "secret"

  labels = {
    label = "my-label"
  }

  replication {
    user_managed {
      replicas {
        location = "us-central1"
      }
      replicas {
        location = "us-east1"
      }
    }
  }
  deletion_protection = true
}

References

[rileykarson]

I'm not sure that we want to apply clientside deletion_protection to this resource. Deletion of most production resources with Terraform will be destructive and we've applied the deletion_protection field to database resources, generally, where deleted resources can mean permanently lost customer data rather than a resolvable disruption. It's a heavy-handed solution compared to using lifecycle.prevent_destroy (which is admittedly difficult to use w/ modules) since it means we permanently make destruction of the resource much more difficult.

That's not to say this this is wholly out of consideration, or that we don't think it's a valid request- I'll leave the issue open in our "Backlog" milestone to allow discussion / for it to collect addtl input from other users. Our stance for resources outside of databases is that this needs to be solved at the Terraform Core level, and we'd filed hashicorp/terraform#24658 to track that feedback (and have emphasized it as a priority through internal channels several times!)

[melinath]

Marking forward/exempt since this is currently in backlog.

[rileykarson]

Closing based on #13661 (comment) + no new feedback.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.