Fix construction of metadata path in KV V2 resource

vault/resource_kv_secret_v2.go

@@ -217,12 +217,33 @@ func kvSecretV2Read(_ context.Context, d *schema.ResourceData, meta interface{})
 	shouldRead := !d.Get("disable_read").(bool)
 
 	path := d.Id()
+	if path == "" {
+		return nil
+	}
 
 	if err := d.Set(consts.FieldPath, path); err != nil {
 		return diag.FromErr(err)
 	}
 
+	// id should be of the form "mount/data/name"
+	// limit substrings to 3 in case name has '/'
+	// in it or if it's a nested secret
+	parsedPath := strings.SplitN(path, "/", 3)
+
+	mount := parsedPath[0]
+	name := parsedPath[2]
+
+	// Set mount and name fields
+	if err := d.Set(consts.FieldMount, mount); err != nil {
+		return diag.FromErr(err)
+	}
+
+	if err := d.Set(consts.FieldName, name); err != nil {
+		return diag.FromErr(err)
+	}
+
 	if shouldRead {
+
 		client, e := provider.GetClient(d, meta)
 		if e != nil {
 			return diag.FromErr(e)
@@ -257,7 +278,10 @@ func kvSecretV2Read(_ context.Context, d *schema.ResourceData, meta interface{})
 
 				// Read & Set custom metadata
 				if _, ok := v[consts.FieldCustomMetadata]; ok {
-					cm, err := readKVV2Metadata(d, client)
+					// construct metadata path
+					parsedPath[1] = "metadata"
+					metadataPath := strings.Join(parsedPath, "/")
+					cm, err := readKVV2Metadata(client, metadataPath)
 					if err != nil {
 						return diag.FromErr(err)
 					}
@@ -274,9 +298,7 @@ func kvSecretV2Read(_ context.Context, d *schema.ResourceData, meta interface{})
 	return nil
 }
 
-func readKVV2Metadata(d *schema.ResourceData, client *api.Client) (map[string]interface{}, error) {
-	path := strings.Replace(d.Id(), consts.FieldData, consts.FieldMetadata, 1)
-
+func readKVV2Metadata(client *api.Client, path string) (map[string]interface{}, error) {
 	log.Printf("[DEBUG] Reading metadata for KVV2 secret at %s", path)
 	resp, err := client.Logical().Read(path)
 	if err != nil {

vault/resource_kv_secret_v2_test.go

@@ -16,6 +16,9 @@ func TestAccKVSecretV2(t *testing.T) {
 	mount := acctest.RandomWithPrefix("tf-kvv2")
 	name := acctest.RandomWithPrefix("tf-secret")
 
+	updatedMount := acctest.RandomWithPrefix("tf-cloud-metadata")
+	updatedName := acctest.RandomWithPrefix("tf-database-creds")
+
 	resource.Test(t, resource.TestCase{
 		Providers: testProviders,
 		PreCheck:  func() { testutil.TestAccPreCheck(t) },
@@ -56,8 +59,28 @@ func TestAccKVSecretV2(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"data_json", "disable_read",
-					"delete_all_versions", "mount",
-					"name", "cas",
+					"delete_all_versions",
+				},
+			},
+			{
+				Config: testKVSecretV2Config_initial(updatedMount, updatedName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, consts.FieldMount, updatedMount),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldName, updatedName),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldPath, fmt.Sprintf("%s/data/%s", updatedMount, updatedName)),
+					resource.TestCheckResourceAttr(resourceName, "delete_all_versions", "true"),
+					resource.TestCheckResourceAttr(resourceName, "data.zip", "zap"),
+					resource.TestCheckResourceAttr(resourceName, "data.foo", "bar"),
+					resource.TestCheckResourceAttr(resourceName, "data.flag", "false"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"data_json", "disable_read",
+					"delete_all_versions",
 				},
 			},
 		},