TF Provider: avoid persisting generated `client_secret` (zitadel_application_v2) in Terraform state
➕Feature Request❓Question✅Solved
Hey team! 
First off, huge thanks for the work you're putting into the Zitadel Terraform provider — it's been a pleasure to work with!
I wanted to raise a topic and check if it's already on your radar: when using the
I was wondering if there is already an issue or PR tracking this. If not, one approach worth considering could be an ephemeral resource that rotates the client secret on each apply (supported since Terraform 1.10). The secret would only ever exist in memory during the apply run and could be passed directly to a downstream resource — such as a Vault or Kubernetes secret — via that provider's write-only attribute support, meaning the secret never needs to touch state at any point in the chain. As a companion change, the
Best Regards, looking forward to your response
Jan
First off, huge thanks for the work you're putting into the Zitadel Terraform provider — it's been a pleasure to work with!
I wanted to raise a topic and check if it's already on your radar: when using the
zitadel_application_v2zitadel_application_v2 resource with an OIDC or API configuration, the generated client_secretclient_secret is currently persisted as a computed attribute in Terraform state. Since Terraform state is often stored in shared backends and may not always be encrypted, this means the secret ends up at rest in a place that may receive less scrutiny than a dedicated secrets store.I was wondering if there is already an issue or PR tracking this. If not, one approach worth considering could be an ephemeral resource that rotates the client secret on each apply (supported since Terraform 1.10). The secret would only ever exist in memory during the apply run and could be passed directly to a downstream resource — such as a Vault or Kubernetes secret — via that provider's write-only attribute support, meaning the secret never needs to touch state at any point in the chain. As a companion change, the
client_secretclient_secret attribute on zitadel_application_v2zitadel_application_v2 itself should be removed, so there is no longer any path by which the secret ends up in state.Best Regards, looking forward to your response
Jan
