1. Environment Variables
Keep PLAIN TEXT secrets out of your
code using Env Variables.
A.
Declare
Variables in .tf configuration files.
variable “password”{
sensitive = true
type = string
description = “The User
Name for DB Master”
}
B.
Now pass this
variable to TF Resource Blocks that need those secerets.
resource “xyz” “abc”{
attr1 = val1
attrn = valn
password = var.password
}
C.
Now use [ export
TF_VAR_ ] to set Environment Variables in any type of Linux CMD Prompt.
export
TF_VAR_password =
rootroot
D.
Now, run $ terraform apply
E.
NOTE: We can use
tools like pass, iPassword etc with this
technique.
F.
-: Everyone
using our code needs to declare these variables first
G.
+: Easy, Keeps
Plain text secrets out of code and VCS, Test Friendly
2. ENCRYPTED
Files (e.g., KMS, PGP, SOPS)
The secrets are Encrypted and cipher
text is stored in a file. We need to check that file in VCS. Now, the problem
is storing the KEY FILE. We store KEY FILE in our Cloud Provider (AWS, GCP
Bucket, Azure Blob Storage, etc) and the cloud automatically encrypts our file.
We can also control user access to this file.
A.
+: secrets are
out of our VCS and code, Secrets are encrypted, versioned, packaged in cloud, no
extra scripts required.
B.
-: Each Cloud
has different way of doing it, Running of lots of commands in Cloud Terminal,
Logs can tell key was used but can’t tell used for decrypting what?, Encurrs
cost, Not Test Friendly
C.
TF with
Different Cloud Provider’s Storage(Encrypted).
I.
TF with AZURE
First, Create these resources in Azure using Azure CLI
# Create resource group
az group create --name
$RESOURCE_GROUP_NAME --location eastus
# Create storage account
az storage account create --resource-group
$RESOURCE_GROUP_NAME --name $STORAGE_ACCOUNT_NAME --sku Standard_LRS --encryption-services blob
# Create blob container
(ALLOW PUBLIC ACCESS & Globally
Unique Name)
az
storage container create --name $CONTAINER_NAME --account-name
$STORAGE_ACCOUNT_NAME
Get the STORAGE ACCESS KEY in a Variable
ACCOUNT_KEY=$(az
storage account keys list --resource-group $RESOURCE_GROUP_NAME --account-name $STORAGE_ACCOUNT_NAME --query '[0].value' -o tsv)
Declare Environment Variable of that key
export
ARM_ACCESS_KEY=$ACCOUNT_KEY
TF CODE :
terraform {
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version =
"=2.46.0"
}
}
backend "azurerm" {
resource_group_name = "-----------"
storage_account_name =
“-----------"
container_name = "----------"
key =
"terraform.tfstate"
}
}
provider "azurerm" {
features {}
}
resource "azurerm_resource_group"
"state-demo-secure" {
name = "state-demo"
location = "eastus"
}
Now, run $ terraform init & $ terraform apply
II.
TF with GCP
Make sure you
have the necessary Cloud Storage permissions on your user account:
·
storage.buckets.create
·
storage.buckets.list
·
storage.objects.get
·
storage.objects.create
·
storage.objects.delete
·
storage.objects.update
in Cloud SHELL type : gcloud services enable [service name]
eg: gcloud services enable storage.googleapis.com
In Terraform config
file, add this GCD Bucket you want to store your file into:
resource "random_id" "bucket_prefix" { byte_length = 8} resource "google_storage_bucket" "default" { name = "${random_id.bucket_prefix.hex}-bucket-tfstate" force_destroy = false location = "US" storage_class = "STANDARD" versioning { enabled = true }}Now, add this block to
confirm your GCS Bucket as backend:
terraform { backend "gcs" {bucket = "BUCKET_NAME "
# google_storage_bucket.default.name prefix = "terraform/state" }}
Run $terraform init & $terraform apply
III.
TF with AWS
In your Terraform Config File, input this code:
terraform{
backend “s3”{
bucket = “unique-bucket-name”
key = “state-file-name”
region = “ap-southeast-2”
encrypt =
true
dynamodb_table
= “terraform-lock”
}
}
3. 3. Secret Stores (Vault, AWS Secrets Manager, GCP Secrets Manager)
A.
+: Keeps Plain
Text secrets out of VCS & Code, Secrets are stored in dedicated secrets
Store with encryption and strict access Control, Everything is defined in code
with no extra scripts, Web UI Experience feels good, Secrets Rotation is
enabled and it means they change after a particular defined time interval, We
get detailed audit logs.
B.
-: Secrets are
not versioned, packaged and tested with code causing errors, Expensive for
large teams, Not test Friendly
