Migrate Vault KV reads per value-sensitivity, not via vault_generic_secret
Date: 2026-07-03 Status: Accepted Decision: hl-ujwi Deciders: sean
Context
Section titled “Context”The Vault provider (>=5.9) deprecates the vault_kv_secret_v2 data source across ~45 reference sites in six Terraform workspaces. The un-deprecated data “vault_generic_secret” could silence every warning with a minimal diff. The replacement the provider intends — the ephemeral vault_kv_secret_v2 resource — only flows into provider config, write-only arguments, and other ephemeral contexts, so a 1:1 swap is impossible.
Decision
Section titled “Decision”Migrate per value-sensitivity using five differentiated mechanisms: ephemeral reads into provider configs; split TF-owned paths written with plain data_json; the PKI issuer data source for public CA material; ephemeral reads into *_wo write-only sinks; documented exceptions where no legal sink exists. vault_generic_secret is rejected as a blanket dodge but noted as a fallback lever.
Rationale
Section titled “Rationale”- vault_generic_secret has identical read-into-state semantics — it dodges the deprecation rather than addressing why secrets land in state, and is plausibly deprecated next
- Sorting every value by true sensitivity is the durable pattern: public material stops pretending to be secret, TF-generated secrets stop round-tripping through reads
Alternatives Considered
Section titled “Alternatives Considered”- Five per-sensitivity mechanisms (chosen): removes secret material from state where the ecosystem supports it; forward-compatible
- Blanket swap to vault_generic_secret (rejected): minimal diff but zero security gain; likely re-deprecated
- Suppress/ignore warnings (rejected): Terraform offers no targeted suppression; warnings would drown real signals
Consequences
Section titled “Consequences”- Positive: migrated sinks no longer persist secrets in state or plan output
- Negative: five patterns to know instead of one; write-only sinks need manual *_wo_revision bumps on rotation (runbook added)
- Neutral: vault_generic_secret remains available as a documented fallback lever