opentofu-schema This Week: KMS Encryption Attributes and Submodule Docs Click

Nov 13, 2026

Last week was quiet but useful for opentofu-schema, the schema library behind OpenTofu editor tooling. Two merged pull requests landed: one teaches the schema about new KMS encryption attributes coming in OpenTofu 1.12.4, the other fixes docs links for modules with submodules. Both matter if you edit OpenTofu in an IDE.

New encryption attributes for gcp_kms and aws_kms

The main change is PR 62, shipped in a commit adding extra encryption data. OpenTofu 1.12.4 adds two optional attributes to key_provider blocks:

gcp_kms gets additional_authenticated_data, a base64 encoded string sent with every encrypt and decrypt call
aws_kms gets encryption_context, a map of string pairs passed to AWS KMS with every GenerateDataKey and Decrypt call

The implementation lives in a new file, internal/schema/1.12/encryption.go. Instead of rewriting the whole encryption block, it patches the existing key_provider dependent body by label. That keeps the diff small and it only fires when the target version is 1.12.4 or newer, which root.go checks with a v1_12_4 version constant.

After a tofu init with 1.12.4, editors will autocomplete both attributes with real descriptions instead of flagging them as unknown.

Version gated schema patches, tested both ways

Worth copying to any schema keyed by OpenTofu version. The tests in core_schema_v1_12_test.go assert the attributes exist for 1.12.4, are optional, have the right cty types (cty.String and cty.Map(cty.String)), and are absent for 1.12.0. So older language clients keep the exact schema they had.

If you use AWS encryption context, a block now validates roughly like this:

terraform {
  encryption {
    key_provider "aws_kms" "primary" {
      kms_key_id = "alias/tofu-state"
      encryption_context = {
        team = "platform"
      }
    }
  }
}

Submodule docs links now resolve

The second change, PR 68, adds submodule support at docs click, landed in a commit extending module_schema.go. When a module registers submodules, the docs “go to definition” path in the module registration now points into the right submodule file instead of only the root module. For authors who split heavy modules into submodules, clicking an attribute in the editor now lands in the file that actually implements it. This is a small quality of life fix for module authors.

What to watch

1.12.4 is now a schema boundary. Expect more version gated patches like the encryption one as minor point releases add attributes.
If you rely on docs click for modules, test your editor client against a module with submodules to confirm the resolved path.
Both changes are invisible to anyone not using OpenTofu 1.12.x. Nothing here breaks older versions.

← All updates