From 98c7f8c16ccab28d3b49d451efec899bc190898b Mon Sep 17 00:00:00 2001
From: Diego Lima <21093781+diegolnasc@users.noreply.github.com>
Date: Sun, 5 May 2024 22:59:12 -0300
Subject: [PATCH] fix: disable random_pass when default user off (#602)

---
 modules/mssql/main.tf         | 3 ++-
 modules/mssql/outputs.tf      | 2 +-
 modules/mysql/main.tf         | 3 ++-
 modules/mysql/outputs.tf      | 2 +-
 modules/postgresql/main.tf    | 3 ++-
 modules/postgresql/outputs.tf | 2 +-
 6 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/modules/mssql/main.tf b/modules/mssql/main.tf
index c947c21a..2f76d8ad 100644
--- a/modules/mssql/main.tf
+++ b/modules/mssql/main.tf
@@ -194,6 +194,7 @@ resource "google_sql_database" "additional_databases" {
 }
 
 resource "random_password" "user-password" {
+  count   = var.enable_default_user ? 1 : 0
   length  = 8
   special = true
 
@@ -226,7 +227,7 @@ resource "google_sql_user" "default" {
   name       = var.user_name
   project    = var.project_id
   instance   = google_sql_database_instance.default.name
-  password   = coalesce(var.user_password, random_password.user-password.result)
+  password   = coalesce(var.user_password, random_password.user-password[0].result)
   depends_on = [null_resource.module_depends_on, google_sql_database_instance.default]
 }
 
diff --git a/modules/mssql/outputs.tf b/modules/mssql/outputs.tf
index 0aea9ece..dc65fbdd 100644
--- a/modules/mssql/outputs.tf
+++ b/modules/mssql/outputs.tf
@@ -57,7 +57,7 @@ output "instance_service_account_email_address" {
 
 output "generated_user_password" {
   description = "The auto generated default user password if not input password was provided"
-  value       = random_password.user-password.result
+  value       = var.enable_default_user ? random_password.user-password[0].result : ""
   sensitive   = true
 }
 
diff --git a/modules/mysql/main.tf b/modules/mysql/main.tf
index 8275d8df..457d02fe 100644
--- a/modules/mysql/main.tf
+++ b/modules/mysql/main.tf
@@ -224,6 +224,7 @@ resource "google_sql_database" "additional_databases" {
 }
 
 resource "random_password" "user-password" {
+  count = var.enable_default_user ? 1 : 0
   keepers = {
     name = google_sql_database_instance.default.name
   }
@@ -269,7 +270,7 @@ resource "google_sql_user" "default" {
   project  = var.project_id
   instance = google_sql_database_instance.default.name
   host     = var.user_host
-  password = var.user_password == "" ? random_password.user-password.result : var.user_password
+  password = var.user_password == "" ? random_password.user-password[0].result : var.user_password
   depends_on = [
     null_resource.module_depends_on,
     google_sql_database_instance.default,
diff --git a/modules/mysql/outputs.tf b/modules/mysql/outputs.tf
index 17b4a4eb..1d9c90e3 100644
--- a/modules/mysql/outputs.tf
+++ b/modules/mysql/outputs.tf
@@ -95,7 +95,7 @@ output "read_replica_instance_names" {
 
 output "generated_user_password" {
   description = "The auto generated default user password if not input password was provided"
-  value       = random_password.user-password.result
+  value       = var.enable_default_user ? random_password.user-password[0].result : ""
   sensitive   = true
 }
 
diff --git a/modules/postgresql/main.tf b/modules/postgresql/main.tf
index 003a15c9..2bbcb47c 100644
--- a/modules/postgresql/main.tf
+++ b/modules/postgresql/main.tf
@@ -231,6 +231,7 @@ resource "google_sql_database" "additional_databases" {
 }
 
 resource "random_password" "user-password" {
+  count = var.enable_default_user ? 1 : 0
   keepers = {
     name = google_sql_database_instance.default.name
   }
@@ -275,7 +276,7 @@ resource "google_sql_user" "default" {
   name     = var.user_name
   project  = var.project_id
   instance = google_sql_database_instance.default.name
-  password = var.user_password == "" ? random_password.user-password.result : var.user_password
+  password = var.user_password == "" ? random_password.user-password[0].result : var.user_password
   depends_on = [
     null_resource.module_depends_on,
     google_sql_database_instance.default,
diff --git a/modules/postgresql/outputs.tf b/modules/postgresql/outputs.tf
index daf17518..9b262d48 100644
--- a/modules/postgresql/outputs.tf
+++ b/modules/postgresql/outputs.tf
@@ -100,7 +100,7 @@ output "read_replica_instance_names" {
 
 output "generated_user_password" {
   description = "The auto generated default user password if not input password was provided"
-  value       = random_password.user-password.result
+  value       = var.enable_default_user ? random_password.user-password[0].result : ""
   sensitive   = true
 }