Feedback on Scaleway Secret Manager

It’s been a long time since I last wrote an article. Tonight I wanted to test the new Scaleway Secret Manager, available in beta, and try to use it with Terraform to set up GitLab tokens for ArgoCD.

Setting Up Secret Manager Access

Since Scaleway made an IAM available in 2022, we’ll start by configuring proper access to our secrets for Terraform. Note that I am not provisioning the IAM through Terraform in this article — to keep things interesting.

First, let’s create an application that will be linked to our Terraform:

Then select the application — we’re going to attach a policy to it:

We arrive in the policy creation tool. Give it a name. As you can see, our application is already selected:

Now let’s add some rules — this is where we restrict the scope to the current project (here default):

Then add the only permission we care about, SecretManagerReadOnly:

Our rule is ready — we can validate:

The IAM is almost fully configured. Go back to the application, on the API Key tab, and create a key dedicated to our Terraform:

Creating a Secret in Secret Manager

Let’s look at the UI provided by Scaleway.

Nothing special here — for those used to HashiCorp Vault, it’s pretty simple: a key, a payload in whatever format you want, and you’re done. You can pick one of the three major regions to store the secret. Note that a 64 KiB limit is enforced, which is more than reasonable. I recommend JSON format — it’s more convenient for automation tools.

Secrets are versioned, which is great. The only UI gripe is that creating a new version doesn’t automatically take the previous one as a starting point — you have to copy it manually. You can disable a version, which makes it inaccessible through the API. That’s great for avoiding automation mishaps.

Using the Secret in Terraform

The Scaleway Terraform provider documentation is fairly high quality.

Hopefully you copied down the access key and secret key associated with our Scaleway application for Terraform earlier; otherwise create a new one and remove the old.

Now let’s write some Terraform code that fetches the value of our secret and sends it as a GitLab token to ArgoCD via the ArgoCD API:

terraform {
  required_providers {
    scaleway = {
      source = "scaleway/scaleway"
      version = ">= 2.14.1"
    }
  }
  required_version = ">= 0.13"
}

data "scaleway_secret" "my_secret" {
  secret_id = "xxx"
}

data "scaleway_secret_version" "my_secret" {
  secret_id  = data.scaleway_secret.my_secret.id
  revision   = data.scaleway_secret.my_secret.version_count
}

resource "argocd_repository_credentials" "git_credentials" {
  url        = "https://gitlab.com"
  username   = "myself"
  password   = jsondecode(base64decode(data.scaleway_secret_version.my_secret.data))["gitlab_argo_token"]
}

Terraform will first fetch the metadata linked to the secret, then call the corresponding version of the secret. To use the secret, you have to decode it (it’s base64-encoded), and then deserialize our JSON.

Feedback

I was pleasantly surprised by the IAM experience. It’s a very promising first step — even though you can only filter down to the project, it’s a good start, and being able to go down to the resource level would be great. At least we have the basic features of a working IAM, which is the main thing.

As for Secret Manager, it does the job — it’s fast. Still, it would be nice to understand how the data is secured from the UI, or at least have a link to more explicit documentation.

Another automation-related point: in the current version of the provider and the API we unfortunately only have a version_count field, so it’s impossible to know what the latest version of the secret is — we infer it from the version count. What happens to that version_count if we drop an intermediate version? If a Scaleway developer happens to read this, please expose the latest version in the scaleway_secret resource 🙂

Over late 2022 and early 2023, Scaleway is showing it can start to rival the US clouds on the basic services every modern infrastructure needs. Keep it up!