Add support for sync strategy to AWS syncs

docs/resources/secrets_sync_aws_parameter_store.md

@@ -99,6 +99,7 @@ resource "doppler_secrets_sync_aws_parameter_store" "backend_prod" {
 - `kms_key_id` (String) The AWS KMS key used to encrypt the parameter (ID, Alias, or ARN)
 - `name_transform` (String) An optional secret name transformer (e.g. DOPPLER_CONFIG in lower-kebab would be doppler-config). Valid transformers: none, camel, upper-camel, lower-snake, tf-var, dotnet, dotnet-env, lower-kebab
 - `secure_string` (Boolean) Whether or not the parameters are stored as a secure string
+- `sync_strategy` (String) Determines whether secrets are synced to a single secret (`single-secret`) as a JSON object or multiple discrete secrets (`multi-secret`). Defaults to `multi-secret` if unspecified.
 - `tags` (Map of String) AWS tags to attach to the parameters
 - `update_resource_tags` (String) Behavior for AWS resource tags on updates (`never` update, `upsert` tags (leaving non-Doppler tags alone), `replace` tags (remove non-Doppler tags))
 

docs/resources/secrets_sync_aws_secrets_manager.md

@@ -94,6 +94,7 @@ resource "doppler_secrets_sync_aws_secrets_manager" "backend_prod" {
 - `kms_key_id` (String) The AWS KMS key used to encrypt the secret (ID, Alias, or ARN)
 - `name_transform` (String) An optional secret name transformer (e.g. DOPPLER_CONFIG in lower-kebab would be doppler-config). Valid transformers: none, camel, upper-camel, lower-snake, tf-var, dotnet, dotnet-env, lower-kebab
 - `path_behavior` (String) The behavior to modify the provided path. Either `add_doppler_suffix` (default) which appends `doppler` to the provided path or `none` which leaves the path unchanged.
+- `sync_strategy` (String) Determines whether secrets are synced to a single secret (`single-secret`) as a JSON object or multiple discrete secrets (`multi-secret`). Defaults to `single-secret` if unspecified.
 - `tags` (Map of String) AWS tags to attach to the secrets
 - `update_metadata` (Boolean) If enabled, Doppler will update the AWS secret metadata (e.g. KMS key) during every sync. If disabled, Doppler will only set secret metadata for new AWS secrets.
 - `update_resource_tags` (String) Behavior for AWS resource tags on updates (`never` update, `upsert` tags (leaving non-Doppler tags alone), `replace` tags (remove non-Doppler tags))

doppler/resource_sync_types.go

@@ -44,7 +44,6 @@ func resourceSyncAWSSecretsManager() *schema.Resource {
 				Optional:    true,
 				ForceNew:    true,
 			},
-
 			"update_resource_tags": {
 				Description:  "Behavior for AWS resource tags on updates (`never` update, `upsert` tags (leaving non-Doppler tags alone), `replace` tags (remove non-Doppler tags))",
 				Type:         schema.TypeString,
@@ -61,7 +60,6 @@ func resourceSyncAWSSecretsManager() *schema.Resource {
 					}
 				},
 			},
-
 			"name_transform": {
 				Description:  fmt.Sprintf("An optional secret name transformer (e.g. DOPPLER_CONFIG in lower-kebab would be doppler-config). Valid transformers: %v", strings.Join(NameTransformers, ", ")),
 				Type:         schema.TypeString,
@@ -78,7 +76,6 @@ func resourceSyncAWSSecretsManager() *schema.Resource {
 					}
 				},
 			},
-
 			"path_behavior": {
 				Description: "The behavior to modify the provided path. Either `add_doppler_suffix` (default) which appends `doppler` to the provided path or `none` which leaves the path unchanged.",
 				Type:        schema.TypeString,
@@ -98,6 +95,13 @@ func resourceSyncAWSSecretsManager() *schema.Resource {
 					}
 				},
 			},
+			"sync_strategy": {
+				Description:  "Determines whether secrets are synced to a single secret (`single-secret`) as a JSON object or multiple discrete secrets (`multi-secret`). Defaults to `single-secret` if unspecified.",
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice([]string{"single-secret", "multi-secret"}, false),
+			},
 		},
 		DataBuilder: func(d *schema.ResourceData) IntegrationData {
 			payload := map[string]interface{}{
@@ -122,6 +126,9 @@ func resourceSyncAWSSecretsManager() *schema.Resource {
 			} else {
 				payload["use_doppler_suffix"] = true
 			}
+			if syncStrategy, ok := d.GetOk("sync_strategy"); ok {
+				payload["sync_strategy"] = syncStrategy
+			}
 			return payload
 		},
 	}
@@ -197,6 +204,13 @@ func resourceSyncAWSParameterStore() *schema.Resource {
 					}
 				},
 			},
+			"sync_strategy": {
+				Description:  "Determines whether secrets are synced to a single secret (`single-secret`) as a JSON object or multiple discrete secrets (`multi-secret`). Defaults to `multi-secret` if unspecified.",
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice([]string{"single-secret", "multi-secret"}, false),
+			},
 		},
 		DataBuilder: func(d *schema.ResourceData) IntegrationData {
 			payload := map[string]interface{}{
@@ -214,6 +228,9 @@ func resourceSyncAWSParameterStore() *schema.Resource {
 			if nameTransform, ok := d.GetOk("name_transform"); ok {
 				payload["name_transform"] = nameTransform
 			}
+			if syncStrategy, ok := d.GetOk("sync_strategy"); ok {
+				payload["sync_strategy"] = syncStrategy
+			}
 			return payload
 		},
 	}