[0.5.31] - July 16, 2024

This article provides an overview of improvements in the Fortanix Data Security Manager (DSM) - Terraform 0.5.31 release.

1.0 Improvements

• Updated the Terraform documentation and examples for the following resources: (JIRA: PROD-8874)

  • dsm_app

  • dsm_azure_sobject

  • dsm_group

  • dsm_secret

  • dsm_sobject

• Updated the Terraform documentation and examples for the following data sources: (JIRA: PROD-8878)

  • dsm_app

  • dsm_aws_group

  • dsm_secret

  • dsm_user

• The following changes were made (JIRA: PROD-8936):

  In the Quorum approval policy

  • Removed extra parameters

  In the app.md resource

  • Added an example for mod_group_permissions

  In the secret.md, dsm_sobject.md, and azure_sobject.mdresources

  • Fixed the expiry date format

2.0 Known Issues

• In the dsm_app data source, even after the new_credential field is set to True, the application API key is not getting regenerated (JIRA: PROD-8948).

• The dsm_aws_group data source is unable to fetch the existing AWS-backed group. It is only able to fetch the group details when the group is being created by the dsm_aws_group resource (JIRA: PROD-8946).

• Updating the rotation policy in dsm_aws_sobject using Terraform does not take effect. (JIRA: DEVOPS-4474)

• Attempts to update the rotation policy in dsm_azure_sobject using Terraform do not take effect. (JIRA: DEVOPS-4475)

• Updating the rotation policy with both intervals, the system considers only the interval_days value. (JIRA: DEVOPS-4477)

• Setting the enable or disable options while creating security objects does not take effect. (JIRA: DEVOPS-3110)

• Deletion of the Key Access Justification policy for security objects for Google Cloud EKM is not supported. (JIRA: DEVOPS-3806)

• Issues in updating the security dsm_sobject (JIRA: DEVOPS-3668).

  • Unable to update the security object’s group.

  • Unable to set an expiration date after the security object is created.

  • Unable to deactivate, destroy, or delete a security object.

• Terraform will detect changes when an approval policy, HMG, or cryptographic policy is added to a group, even when nothing is changed in the TF Body. (JIRA: DEVOPS-3667)

• When you invite a user to a Fortanix DSM account as an account member and add this user to a group as an account administrator using the dsm_group_user_role, even though the user has not accepted the invitation to join the account, the user will still fail to be added to the group. (JIRA: DEVOPS-3666)

• Unable to update the DSM group name if the dsm_group resource contains an hmg parameter. (JIRA: DEVOPS-3736)

• Issue with deleting an account-level quorum policy. (JIRA: DEVOPS-3737)

• Unable to add quorum policy to existing externally-backed DSM groups using Terraform script. (JIRA: DEVOPS-3825)

• Terraform detects change even when the Key Access Justification Policy is not updated. (JIRA: DEVOPS-3807)

• The Key Access Justification policy does not work for a secret key type. (JIRA: DEVOPS-4021)

• Unable to generate a key of type LMS and BLS. (JIRA: DEVOPS-4020)

• Unable to import a key of any type except the Secret key. (JIRA: DEVOPS-4028)

• Unable to create admin apps using Terraform provider. (JIRA: DEVOPS-3669)

• Unable to create apps with authentication methods such as Certificate, Trusted CA, JSON Web Token, or External Directory. (JIRA: DEVOPS-3669)

• An app with an authentication method as an API key and Google Service Account is created with two Terraform resource blocks instead of one Terraform resource block. (JIRA: DEVOPS-3669)

3.0 Downloads

The Fortanix Terraform provider can be accessed from the Fortanix downloads page - https://fortanix.zendesk.com/hc/en-us/articles/6495657315348-Terraform-Provider.