4 ms·
Is there a way to encrypt variables and provide a password to decrypt when executing a plan, so that I can commit my API keys, passwords, etc to source control
by jimmcslim 12y ago
Is there a way to encrypt variables and provide a password to decrypt when executing a plan, so that I can commit my API keys, passwords, etc to source control without fear? I'm thinking something similar to Ansible and its 'vault' concept for variables (sure Chef, Puppet, etc have something similar).
- mitchellh 12y agoThere isn't at the moment, but it is definitely something we need to think through. We didn't want to ship anything broken though (illusion of security), so we deferred this feature until we can think it through more carefully.
- geerlingguy 12y agoOne implementation you might want to take a look at/learn from is Ansible's Vault: http://docs.ansible.com/playbooks_vault.html http://docs.ansible.com/playbooks_vault.html
- peterwwillis 12y agoI'd suggest looking into OpenPGP and see if one of its apps won't work for you (they implement ssh-agent protocol support, and have a couple other apps for doing on-demand crypto)