Transit encryption option

[awwithro]

My team is looking at this tool since it seems to solve the exact problem we're trying to figure out. i.e. storing secrets in SCM to populate vault.

One thing that crossed my mind was that instead of having to manage pub/private keys for doing the encryption would be to leverage vault's transit encryption API: https://www.vaultproject.io/docs/secrets/transit/index.html

I was thinking part of the provider could point to a path in vault for the transit mount and use the api for encrypting/decrypting the secrets before finally storing the value in vault. Am I way off base with this? Would you be amenable to a PR to this effect or is this not something you see in the provider's future?

[syndbg]

@awwithro Sounds like a good idea. We'll think about it and prototype a bit.

The approach seems to solve some issues for us too.