Datasource aws_secretsmanager_secret_version corrupts binary data

[0m1xa]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

terraform version: Terraform v1.1.0
was provider version: 4.20.1

Affected Resource(s)

• aws_secretsmanager_secret_version

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

data "aws_secretsmanager_secret_version" "s" {
  secret_id = "<arn_of_the_binary_data_secret>"
}

resource "local_file" "terraform_binary_data" {
  content  = data.aws_secretsmanager_secret_version.s.secret_binary
  filename = "${path.module}/terraform_binary_data"
}

Debug Output

Panic Output

Expected Behavior

The requested binary data from the AWS secret equals the origin.

Actual Behavior

The requested binary data from the AWS secret differs from the origin.
In my case I used to upload pkcs12 file.
I tested the same case with a sample text file and there was no issue.
I guess it is only related to binary files.

Steps to Reproduce

1. Create a secret in AWS secrets manager with a binary file
2. Request binary data from the created secret and store on the filesystem

aws secretsmanager get-secret-value \
--secret-id <arn_of_the_binary_data_secret>  \
--query SecretBinary \
--profile <profile_name> \
--region <region> \
--output text | base64 -d > ./aws_binary_data

3. Request the same binary data with terraform

data "aws_secretsmanager_secret_version" "s" {
  secret_id = "<arn_of_the_binary_data_secret>"
}

resource "local_file" "terraform_binary_data" {
  content  = data.aws_secretsmanager_secret_version.s.secret_binary
  filename = "${path.module}/terraform_binary_data"
}

4. Compare files
   diff ./aws_binary_data ./terraform_binary_data
5. See that they are not same

Important Factoids

References

• #0000