Answers: <p>This is my solution how to output usernames and passwords:</p>
  
  <p>In the module:</p>
  
  <pre><code>output "mysql_credentials" {
    value = [
      for user in var.mysql_users :
      { "username" = "${user}@${var.cluster_name}" // Hostname is for Azure MySQL service
        "password" = "${random_password.test[user]["result"]}"
      }
    ]
  }
  </code></pre>
  
  <p>In the terraform file referencing the module:</p>
  
  <pre><code>output "mysql_service_credentials" {
    value = module.cluster.mysql_credentials
  }
  </code></pre>
  
  <p>The output:</p>
  
  <pre><code>mysql_credentials = [
    {
      "Password" = "OecheeP1Iequ6zeis2aipai5eiyooL8g"
      "Username" = "stage-cat@stage"
    },
    {
      "Password" = "xaed1EiGh4ahbea4ohjeetouw0Geph8o"
      "Username" = "stage-dog@stage"
    },
    {
      "Password" = "Seu8ieciewoh4Ohl6Ut7em1aiVie1Ao0"
      "Username" = "stage-snake@stage"
    },
  ]
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2020-01-02T11:55:36.360Z
Answers: 2020-01-02T11:55:36.360Z
Answers: Samuel Mumm
Answers: <p>To ensure separation and use in other environments, make sure to have an outputs file and set each password as an output.  <a href="https://www.terraform.io/docs/configuration/outputs.html" rel="nofollow noreferrer">TF Output Docs</a>.  I haven't done much with for each as it was just released last time I used terraform.  I would imagine a way to iterate over passwords and assign them as outputs.</p>
  
  <p>once you have the output set for the module, I would then have my consuming terraform put those values in a password vault of some kind.  You can use Azure's Key Vault.  <a href="https://www.terraform.io/docs/providers/azurerm/r/key_vault.html" rel="nofollow noreferrer">TF Azure Key Vault</a>, or any other solution.  Just ensure that the ops team has access to the destination.  This way there isn't anything introduced between when/where the keys are generated and them being stored, reducing the chance for human error.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-12-10T14:35:16.887Z
Answers: 2019-12-10T14:35:16.887Z
Answers: xtreampb
Body: <p>For a new deployment I want to create databases, users and grants on a previous created MySQL database on azure.</p>
  
  <p>The following code used inside a module creates the environment as expected and I still struggle how to create the outputs of the module and so I get something like the following, to give it to the operations team:</p>
  
  <pre><code>module.test_cluster.mysql_users[cat].password = randompassword1
  module.test_cluster.mysql_users[dog].password = randompassword2
  </code></pre>
  
  <p>Code example:</p>
  
  <pre><code>mysql_databases = [
    "foo",
    "bar"
  ]
  
  mysql_users = [
    "stage-cat",
    "stage-dog",
    "stage-snake"
  ]
  
  mysql_grants = {
    "cat-0" = {
      name     = "stage-cat"
      database = "foo"
      grant    = ["ALL"]
    },
    "cat-1" = {
      name     = "stage-cat"
      database = "bar"
      grant    = ["SELECT", "EXECUTE", "SHOW VIEW"]
    },
    "dog-0" = {
      name     = "stage-dog"
      database = "bar"
      grant    = ["ALL"]
    }
  }
  </code></pre>
  
  <pre><code>resource "mysql_database" "test" {
    for_each = var.mysql_databases
    name     = each.key
  }
  
  resource "mysql_user" "test" {
    for_each           = var.mysql_users
    user               = each.value
    host               = "%"
    tls_option         = "SSL"
    plaintext_password = random_password.test[each.value].result
  }
  
  resource "mysql_grant" "test" {
    for_each   = var.mysql_grants
    user       = mysql_user.test[each.value["name"]].user
    host       = "%"
    database   = each.value["database"]
    privileges = each.value["grant"]
  }
  
  resource "random_password" "test" {
    for_each = var.mysql_users
    length   = 32
    special  = false
  }
  </code></pre>
  
Comments: CC BY-SA 4.0
Comments: 2019-12-06T19:43:58.770Z
Comments: I'm having a hard time understanding your goal.  It sounds like you are able to create your databases and users, but having a hard time providing your ops team the generated password.  Do I understand this correctly?
Comments: xtreampb
Comments: CC BY-SA 4.0
Comments: 2019-12-10T11:51:29.783Z
Comments: Yes @xtreampb , I struggle while creating outputs for the passwords I created.
  On the other hand I am open to other *smarter* ways to solve my issue with terraform.
Comments: Samuel Mumm
Tags: <terraform>
Title: How to create databases, users and grants with terraform mysql and output the created credentials?
UserDisplayName: Samuel Mumm
ThreadText: # How to create databases, users and grants with terraform mysql and output the created credentials?
  
  (Asked by: username_0 on 2019-12-06)
  
  For a new deployment I want to create databases, users and grants on a previous created MySQL database on azure.
  
  The following code used inside a module creates the environment as expected and I still struggle how to create the outputs of the module and so I get something like the following, to give it to the operations team:
  
  ```
  module.test_cluster.mysql_users[cat].password = randompassword1
  module.test_cluster.mysql_users[dog].password = randompassword2
  
  ```
  
  Code example:
  
  ```
  mysql_databases = [
    "foo",
    "bar"
  ]
  
  mysql_users = [
    "stage-cat",
    "stage-dog",
    "stage-snake"
  ]
  
  mysql_grants = {
    "cat-0" = {
      name     = "stage-cat"
      database = "foo"
      grant    = ["ALL"]
    },
    "cat-1" = {
      name     = "stage-cat"
      database = "bar"
      grant    = ["SELECT", "EXECUTE", "SHOW VIEW"]
    },
    "dog-0" = {
      name     = "stage-dog"
      database = "bar"
      grant    = ["ALL"]
    }
  }
  
  ```
  
  ```
  resource "mysql_database" "test" {
    for_each = var.mysql_databases
    name     = each.key
  }
  
  resource "mysql_user" "test" {
    for_each           = var.mysql_users
    user               = each.value
    host               = "%"
    tls_option         = "SSL"
    plaintext_password = random_password.test[each.value].result
  }
  
  resource "mysql_grant" "test" {
    for_each   = var.mysql_grants
    user       = mysql_user.test[each.value["name"]].user
    host       = "%"
    database   = each.value["database"]
    privileges = each.value["grant"]
  }
  
  resource "random_password" "test" {
    for_each = var.mysql_users
    length   = 32
    special  = false
  }
  
  ```
  
  **Tags:** terraform
  
  > **Comments:**
  > **username_1**: I'm having a hard time understanding your goal.  It sounds like you are able to create your databases and users, but having a hard time providing your ops team the generated password.  Do I understand this correctly?  
  > **username_0**: Yes @username_1 , I struggle while creating outputs for the passwords I created. On the other hand I am open to other *smarter* ways to solve my issue with terraform.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_0 on 2020-01-02. Score: 1 | Accepted answer
  
  This is my solution how to output usernames and passwords:
  
  In the module:
  
  ```
  output "mysql_credentials" {
    value = [
      for user in var.mysql_users :
      { "username" = "${user}@${var.cluster_name}" // Hostname is for Azure MySQL service
        "password" = "${random_password.test[user]["result"]}"
      }
    ]
  }
  
  ```
  
  In the terraform file referencing the module:
  
  ```
  output "mysql_service_credentials" {
    value = module.cluster.mysql_credentials
  }
  
  ```
  
  The output:
  
  ```
  mysql_credentials = [
    {
      "Password" = "OecheeP1Iequ6zeis2aipai5eiyooL8g"
      "Username" = "stage-cat@stage"
    },
    {
      "Password" = "xaed1EiGh4ahbea4ohjeetouw0Geph8o"
      "Username" = "stage-dog@stage"
    },
    {
      "Password" = "Seu8ieciewoh4Ohl6Ut7em1aiVie1Ao0"
      "Username" = "stage-snake@stage"
    },
  ]
  
  ```
  
  
  ---
  
  ### Answer by username_1 on 2019-12-10. Score: 2
  
  To ensure separation and use in other environments, make sure to have an outputs file and set each password as an output. [TF Output Docs](https://www.terraform.io/docs/configuration/outputs.html). I haven't done much with for each as it was just released last time I used terraform. I would imagine a way to iterate over passwords and assign them as outputs.
  
  once you have the output set for the module, I would then have my consuming terraform put those values in a password vault of some kind. You can use Azure's Key Vault. [TF Azure Key Vault](https://www.terraform.io/docs/providers/azurerm/r/key_vault.html), or any other solution. Just ensure that the ops team has access to the destination. This way there isn't anything introduced between when/where the keys are generated and them being stored, reducing the chance for human error.
  
  
  ---
  
  