fix!: file should be optional + actualize docs

[gberenice]

what

• Make file optional for SSM secrets - SSM secrets only require path, SOPS secrets only require file
• Add explicit validations:
  • Type must be "sops" or "ssm"
  • SOPS secrets require file attribute
  • SSM secrets require path attribute
• Merge exports into secrets.mixin.tf - Single unified mixin file replacing separate secrets.sops.tf and secrets.ssm.tf
• Add tests for SSM and mixed sources - New test coverage for SSM-only and SOPS+SSM combined configurations

why

• Fix module bug where file attribute was required even for SSM secrets.
• Improve the module with better validations and unified exports.

references

• N/A

Summary by CodeRabbit

Release Notes

• New Features

  • Added support for AWS SSM Parameter Store as a secret source alongside SOPS
  • Introduced support for mixed SOPS and SSM secret sources in a single configuration

• Documentation

  • Updated usage examples with SOPS, AWS SSM Parameter Store, and mixed source scenarios
  • Expanded input documentation with detailed guidance for configuring SOPS and SSM secrets
  • Enhanced validation with specific error messages for missing required fields

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

This pull request refactors the secrets management system to support multiple providers instead of SOPS alone. The implementation is reorganized by moving the secrets module configuration to a new mixin file (exports/secrets.mixin.tf) and removing the previous SOPS-specific configuration. Input validation is added to enforce type-specific requirements (file paths for SOPS, parameter paths for SSM). Documentation is expanded with examples for SOPS, AWS SSM Parameter Store, and mixed-source scenarios. Test coverage is extended to validate SSM-only and mixed SOPS/SSM configurations.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

• Validation logic consistency: Review the three validation blocks across variables.tf and secrets.mixin.tf to ensure they are identical and correctly enforce type-specific attributes (file for SOPS, path for SSM)
• Module source accuracy: Verify the module source (masterpointio/helper/secrets) and version binding in secrets.mixin.tf are correct and available
• Test assertion coverage: Confirm the new test cases properly exercise the SSM and mixed scenarios, and that mock data aligns with actual module behavior
• Documentation examples: Validate that README examples accurately reflect the configuration schema and expected behavior

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title directly addresses the main changes: making the file field optional and updating documentation. It accurately summarizes the core fix and aligns with the PR objectives.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/make-file-optional

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (2)

README.md (1)

13-13: Consider updating the intro text for consistency.

Line 13 still describes the module as being "built to handle SOPS secrets" with future extensibility, but line 75 now states it "currently supports SOPS and AWS SSM Parameter Store." Consider updating this intro paragraph to reflect that SSM support is already implemented.

🔎 Suggested update

-Our initial version is built to handle [SOPS secrets](https://github.com/getsops/sops), but it is designed in a way that it can be easily extended to support other secret providers like AWS SSM Parameter Store, Vault, and more in the future.
+The module currently supports [SOPS secrets](https://github.com/getsops/sops) and AWS SSM Parameter Store, and is designed to be easily extended to support additional secret providers like HashiCorp Vault, AWS Secrets Manager, and more in the future.

exports/secrets.mixin.tf (1)

16-22: Consider aligning the type field definition with variables.tf.

In this mixin, type is defined as a required string (line 19), whereas variables.tf defines it as optional(string, "sops"). This means consumers using the mixin must explicitly specify type for every secret, while the module itself defaults to "sops".

If backward compatibility is important (existing configs omit type), consider making this consistent:

-    type = string
+    type = optional(string, "sops")

Otherwise, if requiring explicit types is intentional for clarity, the current approach is fine — just ensure the README examples reflect that type is required.

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 0c1918b and d7f9631.

📒 Files selected for processing (6)

• README.md
• exports/secrets.mixin.tf
• exports/secrets.sops.tf
• tests/locals.tftest.hcl
• tests/outputs.tftest.hcl
• variables.tf

💤 Files with no reviewable changes (1)

• exports/secrets.sops.tf

🧰 Additional context used

📓 Path-based instructions (1)

**/*.tf

⚙️ CodeRabbit configuration file

**/*.tf: You're a Terraform expert who has thoroughly studied all the documentation from Hashicorp https://developer.hashicorp.com/terraform/docs and OpenTofu https://opentofu.org/docs/.
You have a strong grasp of Terraform syntax and prioritize providing accurate and insightful code suggestions.
As a fan of the Cloud Posse / SweetOps ecosystem, you incorporate many of their best practices https://docs.cloudposse.com/best-practices/terraform/ while balancing them with general Terraform guidelines.

Files:

• variables.tf
• exports/secrets.mixin.tf

🧠 Learnings (7)

📚 Learning: 2024-10-23T18:20:57.022Z

Learnt from: oycyc
Repo: masterpointio/terraform-aws-ssm-agent PR: 28
File: tests/unit.tftest.hcl:34-71
Timestamp: 2024-10-23T18:20:57.022Z
Learning: In the `terraform-aws-ssm-agent` module, the user prefers not to include additional assertions for network and security configurations (e.g., root volume encryption, network interface configurations, and security group associations) in the `verify_launch_template` unit test in `tests/unit.tftest.hcl`.

Applied to files:

• tests/locals.tftest.hcl

📚 Learning: 2024-11-21T13:30:01.588Z

Learnt from: gberenice
Repo: masterpointio/terraform-aws-tailscale PR: 41
File: main.tf:0-0
Timestamp: 2024-11-21T13:30:01.588Z
Learning: In this Terraform module (`main.tf`), read permissions (`ssm:GetParameter`) for SSM parameters are managed by the SSM Agent module (`masterpointio/ssm-agent/aws`), so adding `ssm:GetParameter` permissions in the custom `ssm_policy` module is unnecessary.

Applied to files:

• README.md
• exports/secrets.mixin.tf

📚 Learning: 2025-05-12T15:44:10.001Z

Learnt from: gberenice
Repo: masterpointio/terraform-users-groups-automation-googleworkspace PR: 1
File: examples/import-existing-org/imports.tf:7-7
Timestamp: 2025-05-12T15:44:10.001Z
Learning: In Terraform, local variables defined in one .tf file are available throughout all other .tf files in the same module directory, which allows for referencing locals across different files.

Applied to files:

• exports/secrets.mixin.tf

📚 Learning: 2024-10-23T14:10:29.597Z

Learnt from: oycyc
Repo: masterpointio/terraform-aws-ssm-agent PR: 28
File: tests/main.tftest.hcl:27-28
Timestamp: 2024-10-23T14:10:29.597Z
Learning: In Terraform test files (e.g., `tests/main.tftest.hcl`), module outputs can be accessed without assigning an explicit name to the module.

Applied to files:

• exports/secrets.mixin.tf
• tests/outputs.tftest.hcl

📚 Learning: 2024-11-18T12:59:36.156Z

Learnt from: gberenice
Repo: masterpointio/terraform-spacelift-aws-integrations PR: 2
File: main.tf:2-8
Timestamp: 2024-11-18T12:59:36.156Z
Learning: In this Terraform configuration, `module.this` is defined in `context.tf`.

Applied to files:

• exports/secrets.mixin.tf

📚 Learning: 2024-11-07T21:31:09.849Z

Learnt from: Gowiem
Repo: masterpointio/terraform-aws-ssm-agent PR: 28
File: tests/main.tftest.hcl:14-46
Timestamp: 2024-11-07T21:31:09.849Z
Learning: In `tftest.hcl` files, `export_outputs` is not a valid attribute within a `run` block.

Applied to files:

• tests/outputs.tftest.hcl

📚 Learning: 2024-10-23T14:10:26.952Z

Learnt from: oycyc
Repo: masterpointio/terraform-aws-ssm-agent PR: 28
File: tests/cpu-compatibility.tftest.hcl:1-11
Timestamp: 2024-10-23T14:10:26.952Z
Learning: In `tests/cpu-compatibility.tftest.hcl`, the variables block contains mock values intended for testing purposes.

Applied to files:

• tests/outputs.tftest.hcl

🔇 Additional comments (8)

tests/outputs.tftest.hcl (2)

74-96: LGTM! Well-structured SSM-only test case.

The test properly validates SSM secret retrieval with appropriate assertions for both the secret value and count. Good use of the mock provider defined earlier.

---

98-130: LGTM! Comprehensive mixed sources test.

This test effectively validates the core functionality being introduced in this PR — the ability to combine SOPS and SSM secrets in a single configuration. The assertions properly verify both secret types resolve correctly.

tests/locals.tftest.hcl (2)

91-132: LGTM! Thorough SSM locals validation.

Good coverage of the derived local variables (ssm_secret_mapping, ssm_paths, ssm_secrets). The negative assertion at line 129 verifying sops_secret_mapping is empty is a nice touch to ensure proper filtering.

---

134-180: LGTM! Solid mixed configuration test.

This test effectively validates that SOPS and SSM secrets are properly separated into their respective mappings while still being merged into the unified local.secrets map. Good assertion on the final merged keys.

README.md (1)

44-71: LGTM! Clear documentation for new SSM and mixed source features.

The examples effectively demonstrate both SSM-only and mixed source configurations. The documentation aligns well with the variable definition and validation rules.

variables.tf (1)

16-38: LGTM! Well-designed validations.

The three-tier validation approach (valid type → SOPS requires file → SSM requires path) provides clear, actionable error messages. Using alltrue with list comprehensions is idiomatic Terraform for validating lists of objects. As per Terraform best practices, this fail-fast approach prevents runtime errors.

exports/secrets.mixin.tf (2)

11-12: Verify the module version is correct for this release.

The mixin references version = "1.1.0", but this PR is introducing the SSM support. Ensure this version matches what will be released, or update it accordingly when the new version is published.

---

1-14: LGTM! Clean mixin structure.

The approach of providing a copyable mixin with tflint/checkov annotations is a good developer experience pattern. The local alias secrets = module.secrets.all provides the expected local.secrets["name"] access pattern documented in the README.

[Gowiem]

@gberenice this looks awesome, but we may want to rev minor or major since we're 1) adding variable validation and 2) renaming the mixin file (maybe a reason to major rev?).

What do you think?

[gberenice]

@gberenice this looks awesome, but we may want to rev minor or major since we're 1) adding variable validation and 2) renaming the mixin file (maybe a reason to major rev?).

What do you think?

Makes sense. PR title updated.