<p>This is my solution how to output usernames and passwords:</p>

<p>In the module:</p>

<pre><code>output "mysql_credentials" {
  value = [
    for user in var.mysql_users :
    { "username" = "${user}@${var.cluster_name}" // Hostname is for Azure MySQL service
      "password" = "${random_password.test[user]["result"]}"
    }
  ]
}
</code></pre>

<p>In the terraform file referencing the module:</p>

<pre><code>output "mysql_service_credentials" {
  value = module.cluster.mysql_credentials
}
</code></pre>

<p>The output:</p>

<pre><code>mysql_credentials = [
  {
    "Password" = "OecheeP1Iequ6zeis2aipai5eiyooL8g"
    "Username" = "stage-cat@stage"
  },
  {
    "Password" = "xaed1EiGh4ahbea4ohjeetouw0Geph8o"
    "Username" = "stage-dog@stage"
  },
  {
    "Password" = "Seu8ieciewoh4Ohl6Ut7em1aiVie1Ao0"
    "Username" = "stage-snake@stage"
  },
]
</code></pre>

CC BY-SA 4.0
2020-01-02T11:55:36.360Z
2020-01-02T11:55:36.360Z
Samuel Mumm
<p>To ensure separation and use in other environments, make sure to have an outputs file and set each password as an output.  <a href="https://www.terraform.io/docs/configuration/outputs.html" rel="nofollow noreferrer">TF Output Docs</a>.  I haven't done much with for each as it was just released last time I used terraform.  I would imagine a way to iterate over passwords and assign them as outputs.</p>

<p>once you have the output set for the module, I would then have my consuming terraform put those values in a password vault of some kind.  You can use Azure's Key Vault.  <a href="https://www.terraform.io/docs/providers/azurerm/r/key_vault.html" rel="nofollow noreferrer">TF Azure Key Vault</a>, or any other solution.  Just ensure that the ops team has access to the destination.  This way there isn't anything introduced between when/where the keys are generated and them being stored, reducing the chance for human error.</p>

CC BY-SA 4.0
2019-12-10T14:35:16.887Z
2019-12-10T14:35:16.887Z
xtreampb
<p>For a new deployment I want to create databases, users and grants on a previous created MySQL database on azure.</p>

<p>The following code used inside a module creates the environment as expected and I still struggle how to create the outputs of the module and so I get something like the following, to give it to the operations team:</p>

<pre><code>module.test_cluster.mysql_users[cat].password = randompassword1
module.test_cluster.mysql_users[dog].password = randompassword2
</code></pre>

<p>Code example:</p>

<pre><code>mysql_databases = [
  "foo",
  "bar"
]

mysql_users = [
  "stage-cat",
  "stage-dog",
  "stage-snake"
]

mysql_grants = {
  "cat-0" = {
    name     = "stage-cat"
    database = "foo"
    grant    = ["ALL"]
  },
  "cat-1" = {
    name     = "stage-cat"
    database = "bar"
    grant    = ["SELECT", "EXECUTE", "SHOW VIEW"]
  },
  "dog-0" = {
    name     = "stage-dog"
    database = "bar"
    grant    = ["ALL"]
  }
}
</code></pre>

<pre><code>resource "mysql_database" "test" {
  for_each = var.mysql_databases
  name     = each.key
}

resource "mysql_user" "test" {
  for_each           = var.mysql_users
  user               = each.value
  host               = "%"
  tls_option         = "SSL"
  plaintext_password = random_password.test[each.value].result
}

resource "mysql_grant" "test" {
  for_each   = var.mysql_grants
  user       = mysql_user.test[each.value["name"]].user
  host       = "%"
  database   = each.value["database"]
  privileges = each.value["grant"]
}

resource "random_password" "test" {
  for_each = var.mysql_users
  length   = 32
  special  = false
}
</code></pre>

CC BY-SA 4.0
2019-12-06T19:43:58.770Z
I'm having a hard time understanding your goal.  It sounds like you are able to create your databases and users, but having a hard time providing your ops team the generated password.  Do I understand this correctly?
xtreampb
CC BY-SA 4.0
2019-12-10T11:51:29.783Z
Yes @xtreampb , I struggle while creating outputs for the passwords I created.
On the other hand I am open to other *smarter* ways to solve my issue with terraform.
Samuel Mumm
<terraform>
How to create databases, users and grants with terraform mysql and output the created credentials?
Samuel Mumm
# How to create databases, users and grants with terraform mysql and output the created credentials?

(Asked by: username_0 on 2019-12-06)

For a new deployment I want to create databases, users and grants on a previous created MySQL database on azure.
The following code used inside a module creates the environment as expected and I still struggle how to create the outputs of the module and so I get something like the following, to give it to the operations team:
module.test_cluster.mysql_users[cat].password = randompassword1
module.test_cluster.mysql_users[dog].password = randompassword2

Code example:
mysql_databases = [
  "foo",
  "bar"
]

mysql_users = [
  "stage-cat",
  "stage-dog",
  "stage-snake"
]

mysql_grants = {
  "cat-0" = {
    name     = "stage-cat"
    database = "foo"
    grant    = ["ALL"]
  },
  "cat-1" = {
    name     = "stage-cat"
    database = "bar"
    grant    = ["SELECT", "EXECUTE", "SHOW VIEW"]
  },
  "dog-0" = {
    name     = "stage-dog"
    database = "bar"
    grant    = ["ALL"]
  }
}

resource "mysql_database" "test" {
  for_each = var.mysql_databases
  name     = each.key
}

resource "mysql_user" "test" {
  for_each           = var.mysql_users
  user               = each.value
  host               = "%"
  tls_option         = "SSL"
  plaintext_password = random_password.test[each.value].result
}

resource "mysql_grant" "test" {
  for_each   = var.mysql_grants
  user       = mysql_user.test[each.value["name"]].user
  host       = "%"
  database   = each.value["database"]
  privileges = each.value["grant"]
}

resource "random_password" "test" {
  for_each = var.mysql_users
  length   = 32
  special  = false
}

**Tags:** terraform

> **Comments:**
> **username_1**: I'm having a hard time understanding your goal.  It sounds like you are able to create your databases and users, but having a hard time providing your ops team the generated password.  Do I understand this correctly?  
> **username_0**: Yes @username_1 , I struggle while creating outputs for the passwords I created. On the other hand I am open to other *smarter* ways to solve my issue with terraform.  

---

## 2 answers

### Answer by username_0 on 2020-01-02. Score: 1 | Accepted answer

This is my solution how to output usernames and passwords:
In the module:
output "mysql_credentials" {
  value = [
    for user in var.mysql_users :
    { "username" = "${user}@${var.cluster_name}" // Hostname is for Azure MySQL service
      "password" = "${random_password.test[user]["result"]}"
    }
  ]
}

In the terraform file referencing the module:
output "mysql_service_credentials" {
  value = module.cluster.mysql_credentials
}

The output:
mysql_credentials = [
  {
    "Password" = "OecheeP1Iequ6zeis2aipai5eiyooL8g"
    "Username" = "stage-cat@stage"
  },
  {
    "Password" = "xaed1EiGh4ahbea4ohjeetouw0Geph8o"
    "Username" = "stage-dog@stage"
  },
  {
    "Password" = "Seu8ieciewoh4Ohl6Ut7em1aiVie1Ao0"
    "Username" = "stage-snake@stage"
  },
]


---

### Answer by username_1 on 2019-12-10. Score: 2

To ensure separation and use in other environments, make sure to have an outputs file and set each password as an output. [TF Output Docs](https://www.terraform.io/docs/configuration/outputs.html). I haven't done much with for each as it was just released last time I used terraform. I would imagine a way to iterate over passwords and assign them as outputs.

once you have the output set for the module, I would then have my consuming terraform put those values in a password vault of some kind. You can use Azure's Key Vault. [TF Azure Key Vault](https://www.terraform.io/docs/providers/azurerm/r/key_vault.html), or any other solution. Just ensure that the ops team has access to the destination. This way there isn't anything introduced between when/where the keys are generated and them being stored, reducing the chance for human error.


---

