This article provides an overview of new features, improvements, and resolved issues in the Fortanix Data Security Manager (DSM) - Terraform 0.5.33 release.
1.0 New Features
Added support for creating administrator (admin) application (app) in Terraform Provider (JIRA: PROD-9031).
Added support to delete Quorum approval policy in Terraform Provider (JIRA: PROD-9042).
Added support to delete Key Access Justification (KAJ) policy for a security object (JIRA: PROD-9045).
Added support to generate keys of type BLS and LMS in Terraform Provider (JIRA: PROD-9038).
Added support to import keys of type AES, DES, DES3, HMAC, RSA, EC, DSA, Opaque, Certificate, BIP32, ARIA, KCDSA, EC-KCDSA, BLS, SEED, BLS in Terraform Provider (JIRA: PROD-9037).
Added support for rotating Azure-backed keys in Terraform Provider (JIRA: PROD-9055).
Added support for deletion of Azure-backed and AWS-backed keys in Terraform Provider (JIRA: PROD-9064).
Added support for key move in Terraform Provider (JIRA: PM-363).
Added full support for GCP BYOK in Terraform Provider (JIRA: PM-366).
Added support for copying a key in Terraform Provider (JIRA: PM-365).
2.0 Improvements
Updated the Terraform documentation for the following resources (JIRA: PROD-9094):
dsm_group.md
dsm_acc_quorum_policy.md
dsm_app.md
dsm_app_non_api_key
dsm_csr
dsm_gcp_ekm_sa
dsm_azure_group
dsm_aws_group
dsm_group
dsm_group_crypto_policy
dsm_group_user_role
dsm_plugin
dsm_secret
dsm_sobject
dsm_aws_sobject
dsm_azure_sobject
dsm_gcp_ekm_sa
Updated the Terraform documentation for the following resources (JIRA: PROD-8945, PROD-8946, and PROD-8948):
data_source_sobject
data_source_aws_group
data_source_azure_group
data_source_app
3.0 Bug Fixes
Fixed an issue where the region name was being appended to an Azure-backed group name (JIRA: PROD-9036).
Fixed an issue where the user was unable to update a group associated with a security object (JIRA: PROD-9044).
Fixed an issue where the user was unable to set the key expiration date after a security object is created (JIRA: PROD-9044).
Fixed an issue where the user was unable to deactivate, destroy, compromise, or delete an existing key (JIRA: PROD-9044).
Fixed an issue where the user was unable to enable or disable a security object after creation or during creation (JIRA: PROD-9044).
Fixed an issue where user was unable to modify a group name if the dsm_group resource contains hmg parameter (JIRA: PROD-9047).
Fixed an issue where changes were detected in the KAJ policy even without any changes in the Terraform Provider (JIRA: PROD-9049).
Fixed an issue where user was unable to add quorum policy to existing externally backed groups (JIRA: PROD-9046).
Fixed an issue where the KAJ policy was not working for keys of type secret (JIRA: PROD-9043).
Fixed an issue where the user was unable to add, update, or delete the key rotation policy for AWS-backed keys (JIRA: PROD-9040).
Fixed an issue where the user was unable to add, update, or delete the key rotation policy for Azure-backed keys (JIRA: PROD-9041).
Fixed an issue where user was unable to access an AWS KMS group using data source when the group is created in the Fortanix DSM user interface (UI) (JIRA: PROD-9186).
Fixed an issue where the Terraform Provider was detecting changes for a key even after a key was destroyed or deactivated (JIRA: PROD-9235).
Fixed an issue when performing copy key operation for AWS or Azure-backed group (JIRA: PROD-9244).
Fixed an issue where the user was unable to create an admin app of authentication type secret in Terraform Provider (JIRA: PROD-9264).
Fixed a warning when purging a key in Azure-backed group (JIRA: PROD-9281).
Fixed an issue where the groups parameter was mandatory for a plugin resource (JIRA: PROD-9328).
4.0 Known Issues
gcp_sobject resource detects change even if nothing was changed in the Terraform Provider (JIRA: PROD-9271).
When you invite a user to a Fortanix DSM account as an account member and add this user to a group as an account administrator using the
dsm_group_user_role, even though the user has not accepted the invitation to join the account, the user will still fail to be added to the group (JIRA: PROD-9349).The following operations are not supported in the Terraform Provider admin app (JIRA: PROD-9265):
Disabling the admin app
Setting OAuth for the admin app
Setting allowed IP address for admin app
Creating an admin app with authentication methods such as WorkSpaceCSEAuth and JSON Web Token
Changing the authentication method expiry on the User Interface (UI)
SAN of type
Directory namewhen creating admin app of type Trusted CAChanging authentication method
5.0 Downloads
The Fortanix Terraform provider can be accessed from the Fortanix downloads page - https://fortanix.zendesk.com/hc/en-us/articles/6495657315348-Terraform-Provider.