3 ms·
Some secrets (like IAM access keys) can be encrypted with a public PGP key. Some other secrets (like RDS instance master passwords) can't be encrypted, but I l
by arkadiyt 6y ago
Some secrets (like IAM access keys) can be encrypted with a public PGP key.
Some other secrets (like RDS instance master passwords) can't be encrypted, but I like to use a trick where you have a local provisioner that runs after the instance gets created, which updates the just created DB and sets the password to a random value and prints it to stdout so you can save it in your secrets management tool of choice. The value saved in the terraform state is no longer valid.
Some other other secrets, like elasticache auth tokens - there's no solution, they'll always be available as plaintext in the statefile.
Overall agreed that Terraform needs to do better here.
- time0ut 6y agoI wish they had better coverage for PGP keys. On RDS, my typical pattern is to use Secrets Manager to auto rotate the master password immediately. AWS has sample Lambdas for that various databases.
- gtsteve 6y agoI have a lambda that runs every day to cycle the RDS master password. I create the password using the random provider, and save it to a secrets manager secret - the first time the environment is created, the secret is in plaintext in the state, but it will not be valid the next time the lambda runs (less than 24 hours). You can do the same with ElastiCache auth tokens, and ensure your application reads the token from a value in secrets manager.
- ec109685 6y agoIs there a race condition with the way you rotate the passwords?
- gtsteve 6y agoNo, once you've logged in with MySQL, changing the password doesn't close the connection. For rotating application passwords we use the same technique but we update the usernames, i.e. app_1@'%' becomes app_2@'%', and then rotates back to app_1@'%' to prevent issues with unsynced config files.
- deleted 6y ago[deleted]