fix(kv_secret_v2): prevent panic when payload omitted; enforce ExactlyOneOf for data_json/data_json_wo

CHANGELOG.md

@@ -1,5 +1,9 @@
 ## Unreleased
 
+BUGS:
+
+* Fix panic when creating `vault_kv_secret_v2` resource without specifying either `data_json` or `data_json_wo`. The provider now returns a proper validation error instead of crashing.
+
 ## 5.3.0 (Sep 4, 2025)
 
 FEATURES:

vault/resource_kv_secret_v2.go

@@ -114,6 +114,7 @@ func kvSecretV2Resource(name string) *schema.Resource {
 				ValidateFunc:  ValidateDataJSONFunc(name),
 				Sensitive:     true,
 				ConflictsWith: []string{consts.FieldDataJSONWO},
+				ExactlyOneOf:  []string{consts.FieldDataJSON, consts.FieldDataJSONWO},
 			},
 			consts.FieldDataJSONWO: {
 				Type:          schema.TypeString,

vault/resource_kv_secret_v2_test.go

@@ -9,6 +9,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-testing/plancheck"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"reflect"
+	"regexp"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -314,6 +315,32 @@ func TestAccKVSecretV2_WriteOnlyMigration(t *testing.T) {
 	})
 }
 
+// Test for missing data_json and data_json_wo
+func TestAccKVSecretV2_MissingDataJson(t *testing.T) {
+	t.Parallel()
+	mount := acctest.RandomWithPrefix("tf-kv")
+	name := acctest.RandomWithPrefix("foo")
+
+	config := fmt.Sprintf(`
+%s
+resource "vault_kv_secret_v2" "test" {
+  mount = vault_mount.kvv2.path
+  name  = "%s"
+}
+`, kvV2MountConfig(mount), name)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		Steps: []resource.TestStep{
+			{
+				Config:      config,
+				ExpectError: regexp.MustCompile(`(?i)(exactly one of|must be specified)`),
+			},
+		},
+	})
+}
+
 func readKVData(t *testing.T, mount, name string) {
 	t.Helper()
 	client := testProvider.Meta().(*provider.ProviderMeta).MustGetClient()