4 ms·
Anther solution is to store secrets in the Terraform state and use a secured state backend (eg: S3+KMS) to share them. It makes key sharing and rotation a bit e
by zimbatm 8y ago
Anther solution is to store secrets in the Terraform state and use a secured state backend (eg: S3+KMS) to share them. It makes key sharing and rotation a bit easier while not promoting copy-and-paste.
You can use the "random" provider to generate secrets, the "tls" provider to generate certs and I also wrote a "secret" provider[1] to hold arbitrary secrets.
The best part is that it doesn't require to maintain a long-running process. For small shops it's a good upgrade over storing credentials in code or using git-crypt.
[1]: https://github.com/tweag/terraform-provider-secret https://github.com/tweag/terraform-provider-secret
- yeukhon 8y agoYou don't want to store secrets in state files. Imagine you run a CI/CD system where you run terraform plan. Now secrets is all public.
- toomuchtodo 8y agohttps://github.com/hashicorp/terraform/issues/516 https://github.com/hashicorp/terraform/issues/516 TLDR: Terraform should use Vault for storing secrets in state, but does not support it yet. (it is occasionally unavoidable storing secrets in state due to resources orchestrated)
- zimbatm 8y agoThat's fine. Secrets are market as "sensitive" and not displayed in the plan output.