Empty secrets from variable groups

[mikemowgli]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and Azure DevOps Provider) Version

Terraform v0.13.3

• provider registry.terraform.io/terraform-providers/azuredevops v0.0.1

Affected Resource(s)

• azuredevops_variable_group

Terraform Configuration Files

resource "azuredevops_variable_group" "azure-tf-uat" {
  project_id   = var.infra_analytics_project_id
  name         = "azure-tf-uat"
  description  = "Secrets and variables for Terraform to manage the Azure infra in the UAT subscription"
  allow_access = false

  dynamic "variable" {
    for_each = var.azure_tf_uat_var_group
    iterator = ci_var

    content {
      name  = ci_var.key
      value = ci_var.value
    }
  }

  dynamic "variable" {
    for_each = var.azure_tf_uat_secret_group
    iterator = ci_secret

    content {
      name         = ci_secret.key
      value        = ci_secret.value
      secret_value = ci_secret.value
      is_secret    = true
    }
  }
}

• also tested without secret_value or without value.

Debug Output

https://gist.github.com/mikemowgli/44afe35764b1ab8465d82c619e36e372

Expected Behavior

terraform apply succeeds and secret variables are populated in Azure Devops variable group

Actual Behavior

terraform apply succeeds but secrets are empty

Steps to Reproduce

1. terraform apply

[xuzhang3]

@mikemowgli I cannot reproduce your error.
Can you use output "secret_val" { value = azuredevops_variable_group.azure-tf-uat } print the created resource and check if Terraform uses the correct value?
Test script:

variable "azure_tf_uat_secret_group" {
  type = list(object({
    name = string
    secret_val = string
  }))
  default = [
    {
      name = "key1"
      secret_val = "val1"
    },
    {
      name = "key2"
      secret_val = "val2"
    }
  ]
}

resource "azuredevops_variable_group" "azure-tf-uat" {
  project_id   = data.azuredevops_project.adotest.id
  name         = "azure-tf-uat"
  description  = "Secrets and variables for Terraform to manage the Azure infra in the UAT subscription"
  allow_access = false

  dynamic "variable" {
    for_each = var.azure_tf_uat_secret_group
    iterator = ci_secret

    content {
      name         = ci_secret.value.name
      secret_value = ci_secret.value.secret_val
      is_secret    = true
    }
  }
//  variable {
//    name         = "test"
//    value        = "test"
//    secret_value = "test"
//    is_secret    = true
//  }
}

output "val" {
  value = azuredevops_variable_group.azure-tf-uat
}

output "config" {
  value = var.azure_tf_uat_secret_group
}

[mikemowgli]

I frustratingly cannot reproduce either my own error. So I'm closing this. Apologize for the time wasted and thank you for your feedback @xuzhang3