Secrets that Cannot Be Deleted in One Call and Versions that Expire
protected defaults to false, so one API call deletes a secret and every version; an ephemeral policy that expires a version is the rotation deadline most teams do not have; and a value from a Terraform variable lands in state as well as the manager. Protection on and off by name, a ttl per secret, values optional so first versions can come from a pipeline, and the secrets terraform wrote named.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "secret_manager" {
source = "www.iac-bazaar.com/iac-bazaar/scaleway-secret-manager/scaleway"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
scaleway-secret-manager
Scaleway Secret Manager secrets that cannot be deleted in one call, with
versions that can expire. Works with Terraform and OpenTofu (>= 1.6),
scaleway provider >= 2.0, < 3.0.
protected defaults to false. True here; false needs
accept_unprotected_secrets.
An ephemeral policy is the rotation you do not have: a ttl per
secret disables or deletes the version at expiry.
A value in a Terraform variable lands in state. secret_values is
optional for that reason; write first versions from the CLI or a pipeline,
or use the provider's data_wo on Terraform 1.11+.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
exoscale-kms-key
A key is zonal unless multi-zone, which is the surprise at the first cross-zone restore; and the service has no automatic rotation setting and no flag that refuses deletion, so a key is deleted in one call. Multi-zone unless told otherwise, and outputs that say rotation and deletion protection are not available, so nothing downstream assumes a control that is not there.
alicloud-kms-key
automatic_rotation defaults to Disabled, so today's key material encrypts everything for the life of the account; a key scheduled for deletion is gone after its window with everything encrypted under it; and deletion_protection, the switch that refuses the schedule, defaults to off. Rotation on at your interval, deletion protection on and off by name, the maximum pending window, and an alias.
tencent-kms-key
key_rotation_enabled defaults to false, so today's key material encrypts everything for the life of the account; and a key scheduled for deletion is gone after its window with everything encrypted under it, on a service that has no flag to refuse the schedule. Rotation on for symmetric keys, a 30-day window (the maximum), and an output that says no deletion-protection flag exists.
huawei-kms-key
rotation_enabled defaults to false, so today's key material encrypts everything for the life of the account; and a key scheduled for deletion is gone after its pending window with everything encrypted under it, on a service with no flag to refuse the schedule. Rotation on at your interval, a 30-day window, and an output that says no deletion-protection flag exists.
vault-kv-engine
KV v1 overwrites in place, so a bad write is the end of the previous secret; cas_required defaults to false, so two writers that read the same version both succeed and the second silently replaces the first; and version history is unbounded by default. v2 always, check-and-set on (off by name), versions bounded by count and age, the mount's lease ceilings set rather than inherited.
ibm-key-protect-key
The rotation policy is a separate resource nobody creates, so a key made today encrypts everything for the life of the account; dual_auth_delete, the control that makes deletion a two-person act, is off by default; and force_delete would remove a key buckets still use. Rotation on at your interval, dual authorization on (off by name), force delete never, the instance created when none is given.