azure - How to get secret value from keyvault that were created by other terraform deployment?

Question

I have a keyvault of type azurerm_key_vault with name key-vault-1 and the secret of type azurerm_key_vault_secret inside of it named secret-password-1. Those are defined in the other deployment.

How to access the value of secret-password-1 from other modules/deployments?

question from:https://stackoverflow.com/questions/65626714/how-to-get-secret-value-from-keyvault-that-were-created-by-other-terraform-deplo

Answer 1

You can use Data Source: azurerm_key_vault_secret to access the value of the secret in an existing Key vault. Of course, the deployment that creates the Key vault and the secret must execute before the module.

If the two deployments are in the modules, then you need to define the output for the secret in the Key Vault deployment. Here is an example:

main.tf

module "keyvault" {
  source = "./modules/keyvault"
  ...
}

module "other_deployment" {
  source = ./modules/other_deployment

  secret-password-1 = module.keyvault.secret-password-1
}

./modules/keyvault/main.tf

...
output "secret-password-1" {
  value = azurerm_key_vault_secret.exxample.value
}

./modules/other_deployment/main.tf

variable "secret-password-1" {}

This example shows how you can quote the secret created in another module.