Enable rotation config and topics in modules/secret-manager (#4141)

Author: dshah22

modules/secret-manager/README.md

@@ -7,6 +7,7 @@ This module allows managing one or more secrets with versions and IAM bindings.
 - [Regional Secrets](#regional-secrets)
 - [IAM Bindings](#iam-bindings)
 - [Secret Versions](#secret-versions)
+- [Secret Rotation](#secret-rotation)
 - [Context Interpolations](#context-interpolations)
 - [Variables](#variables)
 - [Outputs](#outputs)
@@ -155,6 +156,29 @@ foo-secret
 # tftest-file id=0 path=test-data/secret-b.txt
 ```
 
+## Secret Rotation
+
+Automated rotation schedules and Pub/Sub notification topics can be configured on both global and regional secrets via `rotation_config` and `topics`. Note that the Secret Manager API requires at least one Pub/Sub topic when rotation is configured.
+
+```hcl
+module "secret-manager" {
+  source     = "./fabric/modules/secret-manager"
+  project_id = var.project_id
+  secrets = {
+    test-rotated = {
+      rotation_config = {
+        period    = "7776000s" # 90 days
+        next_time = "2026-12-01T00:00:00Z"
+      }
+      topics = [
+        "projects/project-id/topics/secret-rotation-topic"
+      ]
+    }
+  }
+}
+# tftest modules=1 resources=1 skip-tofu
+```
+
 ## Context Interpolations
 
 Similarly to other core modules in this repository, this module also supports context-based interpolations, which are populated via the `context` variable.

modules/secret-manager/global.tf

@@ -71,14 +71,19 @@ resource "google_secret_manager_secret" "default" {
       }
     }
   }
-  # dynamic "rotation" {
-  #   for_each = try(each.value.rotation_config, null) == null ? [] : [""]
-  #   content {
-  #     next_rotation_time = each.value.rotation_config.next_time
-  #     rotation_period    = each.value.rotation_config.period
-  #   }
-  # }
-  # topics
+  dynamic "rotation" {
+    for_each = try(each.value.rotation_config, null) == null ? [] : [""]
+    content {
+      next_rotation_time = each.value.rotation_config.next_time
+      rotation_period    = each.value.rotation_config.period
+    }
+  }
+  dynamic "topics" {
+    for_each = coalesce(try(each.value.topics, null), [])
+    content {
+      name = topics.value
+    }
+  }
   lifecycle {
     ignore_changes = [
       rotation[0].next_rotation_time

modules/secret-manager/regional.tf

@@ -43,14 +43,19 @@ resource "google_secret_manager_regional_secret" "default" {
       )
     }
   }
-  # dynamic "rotation" {
-  #   for_each = try(each.value.rotation_config, null) == null ? [] : [""]
-  #   content {
-  #     next_rotation_time = each.value.rotation_config.next_time
-  #     rotation_period    = each.value.rotation_config.period
-  #   }
-  # }
-  # topics
+  dynamic "rotation" {
+    for_each = try(each.value.rotation_config, null) == null ? [] : [""]
+    content {
+      next_rotation_time = each.value.rotation_config.next_time
+      rotation_period    = each.value.rotation_config.period
+    }
+  }
+  dynamic "topics" {
+    for_each = coalesce(try(each.value.topics, null), [])
+    content {
+      name = topics.value
+    }
+  }
   lifecycle {
     ignore_changes = [
       rotation[0].next_rotation_time

modules/secret-manager/variables.tf

@@ -100,13 +100,20 @@ variable "secrets" {
         write_only_version = optional(number)
       }))
     })), {})
-    # rotation_config = optional(object({
-    #   next_time = string
-    #   period    = number
-    # }))
-    # topics
+    rotation_config = optional(object({
+      next_time = optional(string)
+      period    = string
+    }))
+    topics = optional(list(string))
   }))
   default = {}
+  validation {
+    condition = alltrue([
+      for k, v in var.secrets :
+      try(v.rotation_config, null) == null || (try(length(v.topics), 0) > 0)
+    ])
+    error_message = "At least one topic must be configured when rotation_config is set."
+  }
   validation {
     condition = alltrue([
       for k, v in var.secrets :