{
  "tool": "stacktoit",
  "action_id": "API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq",
  "mode": "STACKIT_API",
  "phase": "SECURITY",
  "operation": {
    "spec": "EXTERNAL_SECRETS_MANAGER_VAULT",
    "service": "secrets-manager-vault",
    "api_version": "v1",
    "operation_id": "WriteSecret",
    "method": "POST",
    "path_template": "/v1/{instanceId}/data/{path}",
    "base_url": "https://prod.sm.eu01.stackit.cloud",
    "inputs": [
      {
        "name": "instanceId",
        "in": "PATH",
        "source": "ACTION_OUTPUT",
        "value": "TF/stackit_secretsmanager_instance.migrated_secrets#instance_id"
      },
      {
        "name": "path",
        "in": "PATH",
        "source": "ENV",
        "value": "STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ"
      },
      {
        "name": "username",
        "in": "LOGIN",
        "source": "ACTION_OUTPUT",
        "value": "TF/stackit_secretsmanager_user.migration#username"
      },
      {
        "name": "password",
        "in": "LOGIN",
        "source": "ACTION_OUTPUT",
        "value": "TF/stackit_secretsmanager_user.migration#password",
        "sensitive": true
      },
      {
        "name": "secretDocument",
        "in": "BODY",
        "source": "ENV",
        "value": "STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_MQ",
        "sensitive": true
      }
    ],
    "expected_response": {
      "status": 200
    },
    "idempotency": "READ_BEFORE_CREATE",
    "lookup": {
      "operation_id": "ReadSecret",
      "method": "GET",
      "path_template": "/v1/{instanceId}/data/{path}",
      "found_status": 200,
      "absent_status": 404
    },
    "auth": "the username and password of a Secrets Manager user of the instance with write access (the stackit_secretsmanager_user the draft creates, write_enabled = true), which the script exchanges for a token (login) and sends as X-Vault-Token",
    "maturity": "UNKNOWN",
    "ownership": {
      "kind": "OWN_API_OBJECT",
      "source_of_truth": "API",
      "terraform_manages": false,
      "api_manages": true,
      "order": "AFTER_TF_CREATE",
      "fields": [
        "secret"
      ],
      "drift": "OpenTofu manages no secret: the call creates or claims it through the secrets-manager-vault API after the OpenTofu step of stackit_secretsmanager_instance.migrated_secrets, so a later tofu apply neither reverts nor reports a change of it made by hand; a person reads it back with ReadSecret after the call, and whenever drift is suspected. The secret is a key of the Vault KV version 2 store of stackit_secretsmanager_instance.migrated_secrets; the pinned provider has no resource for it, so a later tofu apply neither writes nor reverts it, and the value the script wrote is the person's document, not anything the draft holds."
    }
  },
  "depends_on": [
    "TF/stackit_secretsmanager_instance.migrated_secrets",
    "TF/stackit_secretsmanager_user.migration"
  ],
  "preconditions": [
    {
      "kind": "action-complete",
      "params": {
        "action": "TF/stackit_secretsmanager_instance.migrated_secrets"
      }
    },
    {
      "kind": "decision-answered",
      "params": {
        "decision": "DEC-GEN-CONVERT-API-OPT-IN"
      }
    },
    {
      "kind": "project-exists"
    }
  ],
  "postconditions": [
    {
      "kind": "property-matches",
      "params": {
        "instance": "stackit_secretsmanager_instance.migrated_secrets",
        "property": "a current version of the secret at the path STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ names (ReadSecret, GET /v1/{instanceId}/data/{path})",
        "value": "exists"
      },
      "execution": "MANUAL"
    }
  ],
  "rollback": [
    {
      "capability": "MANUAL",
      "how": "the script deletes nothing and no step of the plan does; if a version was written by mistake, a person removes it with the Secrets Manager's own tools (this plan does not state how a version or a secret is deleted or whether it can be restored)"
    }
  ],
  "executable": false,
  "blocked_by": [
    "DEC-GEN-CONVERT-API-OPT-IN"
  ],
  "terraform_outputs": [
    {
      "input": "instanceId",
      "variable": "STACKIT_INPUT_INSTANCEID",
      "output": "stackit_secretsmanager_instance_migrated_secrets_instance_id"
    },
    {
      "input": "username",
      "variable": "STACKIT_INPUT_USERNAME",
      "output": "stackit_secretsmanager_user_migration_username"
    },
    {
      "input": "password",
      "variable": "STACKIT_INPUT_PASSWORD",
      "output": "stackit_secretsmanager_user_migration_password"
    }
  ],
  "script": "execution/api/secrets-manager-vault/003-writesecret.sh",
  "environment": [
    "STACKIT_API_URL_SECRETS_MANAGER_VAULT",
    "STACKIT_INPUT_INSTANCEID",
    "STACKIT_INPUT_PASSWORD",
    "STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_MQ",
    "STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ",
    "STACKIT_INPUT_USERNAME"
  ]
}