How to Manage Secrets in Terraform?

▬▬▬▬▬ Experience & Location 💼 ▬▬▬▬▬
► I’m a Senior Software Engineer at Juniper Networks (12+ years of experience)
► Located in San Francisco Bay Area, CA (US citizen)

▬▬▬▬▬▬ Connect with me 👋 ▬▬▬▬▬▬

▬▬▬▬▬▬ Related videos 👨‍🏫 ▬▬▬▬▬▬

▬▬▬▬▬▬▬ Timestamps ⏰ ▬▬▬▬▬▬▬
0:00 Intro
3:46 Environment Variables
10:12 Encrypted Files (KMS, PGP, SOPS)
14:08 Secret Stores (Vault, AWS/GCP Secrets Manager)

▬▬▬▬▬▬▬ Source Code 📚 ▬▬▬▬▬▬▬

#terraform #devops #cloud

[iwutmbk]

Another cool way is to store the sensitive values in SSM parameter store and then using the data source to pull it into your terraform.

[yasharsultanov]

Антон, вы даже не сможете представить, как сильно вы помогли мне. Спасибо!

[kruchkov.alexandr]

Спасибо, очень полезный урок, я даже сохранил в закладках.

[gorandev]

Very informative video, I didn't know about the "pass" password manager. Thank you.

[azerbaijan]

Thank you for this great video. You do priceless things here.

[karthikreddy]

Hi Anton, As usual really great content. Kudos to you for putting such high quality content everytime.

May be you can do playlist on central Logging solutions for k8s pods. Just a suggestion for future videos. Thanks again. Appreciate the effort you put behind these vidoes. 🎉

[Wzooff]

Due to recent aws provider changes we can get rid of passwords for rds using manage_master_user_password attribute :)

Databases for me was the last thing that required creating passwords. Everything else can be managed with iam roles without passwords/keys at all

[scottamolinari]

A very k8s-centric (i.e. the private key stays inside the cluster) method to encrypting secrets and being able to save them external to the cluster is via Bitnami's sealed secrets.

[aminniktash]

great video especially the second part, Thanks in advance, Would you please explain after securing the secrets with the latest method, are we still have them as plain text on the state file or not? you didn't demo that part and the end of your video

[suoncha]

Awsome! Btw, i’m using Vault hosting on an EC2 for storing secrets recently. What ur opinion abt its downsides when compare to managed services? Beside having to manage it urself lol

[SANTOSHSINGHU]

is there a way to extract credentials from azure vault and run terraform and pass these values to azure pipeline solutions..I m looking for similar solution in azure around service principle

[yogithakakarla]

Show us how to do using hashicorp vault

[samratchaudhary]

Sir, can you teach us how to create cross-account deployment using terraform module in jenkins CI/CD pipeline?

[kruchkov.alexandr]

Am I understanding correctly that the combination of sops+kms is not the best choice because the password is stored in the state?
So, from the perspective of GIT + CI/CD, it's beautiful and protected, but the state itself contains passwords and tokens.

[lakshayarora]

Great video. I would like to know why pass doesn't pops up again to enter the passphrase (to retrieve the password ) once we have got the password. So, every time we need the password, it should ask for the passphrase everytime

[YordisPrieto]

What about the usage of random_password resource?

Would you recommend to remove it? Or is there anyway to leverage random_password resource securely? I am in DigitalOcean so I do not have KMS or something alike at the moment.

[domw]

looks like AWS secret manager is the easiest way

[HKnSLK]

Ugh. Why are you using MacOS? With your knowledge, I was assuming you'd be running Linux...

[shantipahari]

db_creds = jsondecode(
│ 7:
│ 8: )
│ ├────────────────
│ │ while calling jsondecode(str)
│
│ Call to function "jsondecode" failed: invalid character '"' after object key:value pair.