[Feature] Add databricks_secret write-only attributes

Author: ashenm

common/resource.go

@@ -8,7 +8,7 @@ import (
 	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 	"github.com/databricks/terraform-provider-databricks/common"
-
+	"github.com/hashicorp/go-cty/cty"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
@@ -35,16 +35,41 @@ func readSecret(ctx context.Context, w *databricks.WorkspaceClient, scope string
 	}
 }
 
+func getStringValue(d *schema.ResourceData) (string, error) {
+	woValue, diags := d.GetRawConfigAt(cty.GetAttrPath("string_value_wo"))
+	if !diags.HasError() && woValue.Type().Equals(cty.String) && !woValue.IsNull() {
+		return woValue.AsString(), nil
+	}
+	if v, ok := d.GetOk("string_value"); ok {
+		return v.(string), nil
+	}
+	return "", fmt.Errorf("failed to get one of attributes `string_value_wo` or `string_value`")
+}
+
 // ResourceSecret manages secrets
 func ResourceSecret() common.Resource {
 	p := common.NewPairSeparatedID("scope", "key", "|||")
 	s := map[string]*schema.Schema{
 		"string_value": {
 			Type:         schema.TypeString,
 			ValidateFunc: validation.StringIsNotEmpty,
-			Required:     true,
-			ForceNew:     true,
+			Optional:     true,
+			Sensitive:    true,
+			ExactlyOneOf: []string{"string_value", "string_value_wo"},
+		},
+		"string_value_wo": {
+			Type:         schema.TypeString,
+			ValidateFunc: validation.StringIsNotEmpty,
+			Optional:     true,
+			WriteOnly:    true,
 			Sensitive:    true,
+			RequiredWith: []string{"string_value_wo_version"},
+			ExactlyOneOf: []string{"string_value", "string_value_wo"},
+		},
+		"string_value_wo_version": {
+			Type:         schema.TypeInt,
+			Optional:     true,
+			RequiredWith: []string{"string_value_wo"},
 		},
 		"scope": {
 			Type:         schema.TypeString,

secrets/resource_secret.go

@@ -121,6 +121,90 @@ func TestResourceSecretCreate(t *testing.T) {
 	assert.Equal(t, "foo|||bar", d.Id())
 }
 
+func TestResourceSecretCreate_WriteOnlyValue(t *testing.T) {
+	d, err := qa.ResourceFixture{
+		Fixtures: []qa.HTTPFixture{
+			{
+				Method:   "POST",
+				Resource: "/api/2.0/secrets/put",
+				ExpectedRequest: workspace.PutSecret{
+					StringValue: "SparkIsTh3Be$t",
+					Scope:       "foo",
+					Key:         "bar",
+				},
+			},
+			{
+				Method:   "GET",
+				Resource: "/api/2.0/secrets/list?scope=foo",
+				Response: workspace.ListSecretsResponse{
+					Secrets: []workspace.SecretMetadata{
+						{
+							Key:                  "bar",
+							LastUpdatedTimestamp: 12345678,
+						},
+					},
+				},
+			},
+		},
+		Resource: ResourceSecret(),
+		State: map[string]any{
+			"scope":                   "foo",
+			"key":                     "bar",
+			"string_value_wo":         "SparkIsTh3Be$t",
+			"string_value_wo_version": 1,
+		},
+		Create: true,
+	}.Apply(t)
+	assert.NoError(t, err)
+	assert.Equal(t, "foo|||bar", d.Id())
+	assert.Equal(t, "", d.Get("string_value"))
+}
+
+func TestResourceSecretUpdate_WriteOnlyValueVersionChange(t *testing.T) {
+	d, err := qa.ResourceFixture{
+		Fixtures: []qa.HTTPFixture{
+			{
+				Method:   "POST",
+				Resource: "/api/2.0/secrets/put",
+				ExpectedRequest: workspace.PutSecret{
+					StringValue: "SparkIsTh3Be$t-v2",
+					Scope:       "foo",
+					Key:         "bar",
+				},
+			},
+			{
+				Method:   "GET",
+				Resource: "/api/2.0/secrets/list?scope=foo",
+				Response: workspace.ListSecretsResponse{
+					Secrets: []workspace.SecretMetadata{
+						{
+							Key:                  "bar",
+							LastUpdatedTimestamp: 12345679,
+						},
+					},
+				},
+			},
+		},
+		Resource: ResourceSecret(),
+		InstanceState: map[string]string{
+			"scope":                   "foo",
+			"key":                     "bar",
+			"string_value_wo_version": "1",
+		},
+		State: map[string]any{
+			"scope":                   "foo",
+			"key":                     "bar",
+			"string_value_wo":         "SparkIsTh3Be$t-v2",
+			"string_value_wo_version": 2,
+		},
+		Update: true,
+		ID:     "foo|||bar",
+	}.Apply(t)
+	assert.NoError(t, err)
+	assert.Equal(t, "foo|||bar", d.Id())
+	assert.Equal(t, 12345679, d.Get("last_updated_timestamp"))
+}
+
 func TestResourceSecretCreate_Error(t *testing.T) {
 	d, err := qa.ResourceFixture{
 		Fixtures: []qa.HTTPFixture{