Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Description

It would be great if the compute_vpn_tunnel's shared_secret optionally could be provided as a Write-only argument.

Especially when both sides of the VPN are configured using the same Terraform workspace it would fit perfectly to have the IPSec pre-shared key provided by ephemeral.random_password as there's then really no need for anyone to actually access that secret.

(Yes, that would of course require the corresponding write-only argument to be supported by the provider resource used for the other side of the VPN tunnel.)

New or Affected Resource(s)

• google_compute_vpn_tunnel

Potential Terraform Configuration

locals {
  ipsec_secret_version = 1
}

ephemeral "random_password" "ipsec" {
  length  = 32
  special = false
}

resource "google_compute_vpn_tunnel" "tunnel" {
  name                     = "tunnel-tunnel"
  shared_secret_wo         = ephemeral.random_password.ipsec.result
  shared_secret_wo_version = local.ipsec_secret_version
  ...
}

resource "other_provider_vpn_connection" "tunnel" {
  name                     = "tunnel-tunnel"
  preshared_key_wo         = ephemeral.random_password.ipsec.result
  preshared_key_wo_version = local.ipsec_secret_version
  ...
}

References

• Write-only attributes in the Google Cloud provider