How to add api-key to google secret-manager

Question

With Terraform GCP provider 4.30.0, I can now create an google maps api key and restrict it.

resource "google_apikeys_key" "maps-api-key" {
  provider     = google-beta
  name         = "maps-api-key"
  display_name = "google-maps-api-key"
  project      = local.project_id
  restrictions {
    api_targets {
      service = "static-maps-backend.googleapis.com"
    }
    api_targets {
      service = "maps-backend.googleapis.com"
    }
    api_targets {
      service = "places-backend.googleapis.com"
    }

    browser_key_restrictions {
      allowed_referrers = [
        "https://${local.project_id}.ey.r.appspot.com/*", # raw url to the app engine service
        "*.example.com/*"    # Custom DNS name to access to the app
      ]
    }
  }
}

The key is created and appears in the console as expected and I can see the API_KEY value.

When I deploy my app, I want it to read the API_KEY string.

My node.js app already reads secrets from secret manager, so I want to add it as a secret.

Another approach could be for the node client library to read the API credential directly, instead of using secret-manager, but I haven't found a way to do that.

I can't work out how to read the key string and store it in the secret.

The terraform resource describes the output

key_string - Output only. An encrypted and signed value held by this key. This field can be accessed only through the GetKeyString method.

I don't know how to call this method in Terraform, to pass the value to a secret version. This doesn't work.

  v1 = { enabled = true, data = resource.google_apikeys_key.maps-api-key.GetKeyString }

Answer 1

Referencing attributes and arguments does not work the way you tried it. You did quote the correct attribute though, but just failed to specify it:

v1 = {
  enabled = true, 
  data = resource.google_apikeys_key.maps-api-key.key_string
}

Make sure to understand how referencing attributes in Terraform works [1].

---

[1] https://www.terraform.io/language/expressions/references#references-to-resource-attributes