feat(secrets-manager): enforce mutual exclusivity between ACL and KMS key flags

s-inter · rubenhoenle · commit c2b2f8125c1b · 2026-03-27T11:14:10.000+01:00
diff --git a/internal/cmd/secrets-manager/instance/update/update.go b/internal/cmd/secrets-manager/instance/update/update.go
@@ -111,6 +111,7 @@ func configureFlags(cmd *cobra.Command) {
 	cmd.Flags().String(kmsServiceAccountEmailFlag, "", "Service account email for KMS access")
 
 	cmd.MarkFlagsRequiredTogether(kmsKeyIdFlag, kmsKeyringIdFlag, kmsKeyVersionFlag, kmsServiceAccountEmailFlag)
+	cmd.MarkFlagsMutuallyExclusive(aclFlag, kmsKeyIdFlag)
 }
 
 func parseInput(p *print.Printer, cmd *cobra.Command, inputArgs []string) (*inputModel, error) {

Original file line number	Diff line number	Diff line change
`@@ -111,6 +111,7 @@ func configureFlags(cmd *cobra.Command) {`
`111`	`111`	`cmd.Flags().String(kmsServiceAccountEmailFlag, "", "Service account email for KMS access")`
`112`	`112`
`113`	`113`	`cmd.MarkFlagsRequiredTogether(kmsKeyIdFlag, kmsKeyringIdFlag, kmsKeyVersionFlag, kmsServiceAccountEmailFlag)`
	`114`	`+ cmd.MarkFlagsMutuallyExclusive(aclFlag, kmsKeyIdFlag)`
`114`	`115`	`}`
`115`	`116`
`116`	`117`	`func parseInput(p print.Printer, cmd cobra.Command, inputArgs []string) (*inputModel, error) {`