I am attempting to create an SQL user using a password retrieved from the Google Secret Manager in Terraform, my database is Postgres-15. Below is my Terraform file:
resource "random_string" "db_name_suffix" {
length = 4
special = false
upper = false
}
resource "google_sql_database_instance" "cloud_sql" {
# Instance info
name = "cloud-sql-private-${random_string.db_name_suffix.result}"
region = var.region
database_version = var.cloud_sql_database_version
deletion_protection = false
root_password = "abcABC123!"
settings {
# Region and zonal availability
availability_type = var.cloud_sql_availability_type
location_preference {
zone = var.cloud_sql_location_preference
}
# Machine Type
tier = var.cloud_sql_machine_type
# Storage
disk_size = var.cloud_sql_default_disk_size
# Connections
ip_configuration {
ipv4_enabled = false
private_network = google_compute_network.custom.id
}
# Backups
backup_configuration {
enabled = true
start_time = "06:00"
}
}
depends_on = [
google_service_networking_connection.private-vpc-connection
]
}
data "google_secret_manager_secret_version" "cloud-sql-admin-user-password" {
secret = "cloud-sql-admin-user-password"
version = "latest"
project = var.project_id
}
resource "google_sql_database" "spring-api-database" {
name = "helloworld_db"
instance = google_sql_database_instance.cloud_sql.name
}
resource "google_sql_user" "new-user" {
name = data.google_secret_manager_secret_version.cloud-sql-admin-user-password.secret_data
instance = google_sql_database_instance.cloud_sql.name
password = data.google_secret_manager_secret_version.cloud-sql-admin-user-password.secret_data
}
the file is long, so just focus on this code block:
data "google_secret_manager_secret_version" "cloud-sql-admin-user-password" {
secret = "cloud-sql-admin-user-password"
version = "latest"
project = var.project_id
}
......
resource "google_sql_user" "new-user" {
name = data.google_secret_manager_secret_version.cloud-sql-admin-user-password.secret_data
instance = google_sql_database_instance.cloud_sql.name
password = data.google_secret_manager_secret_version.cloud-sql-admin-user-password.secret_data
}
To verify that I am using the correct secret value, I set both the username and password to the same value. When I execute terraform apply
, the user is created successfully with the username aStrongPassword123
, which matches the value of my secret.
database user list:
However, despite expecting the password to be aStrongPassword123, attempting to log in results in the error "FATAL: password authentication failed."
login message:
If I create user using the Cloud Console UI, I can log in successfully. Can someone please help me identify what might be wrong with my Terraform code block?