Show HN: Digger – an Open Source Terraform automation and collaboration tool

Re:Show HN: Digger – an Open Source Terraform automation and... by evantbyrne on Sunday July 09, 2023 @03:56PM (#36658244)

Any CD is going to require some kind of authentication key. To minimize the surface area of a potential leak, create a user in AWS for the tool, only grant it access to the resources needed, and then create a key for that user to place in your CI. You should also enable audit trails in your AWS account so you can monitor for unusual activity.

[ Parent | on HN ]

Re:Show HN: Digger – an Open Source Terraform automation and... by klysm on Sunday July 09, 2023 @04:53PM (#36658772)

You should create a role, not a user IMO. Also how do you manage that role/user? Via terraform?

[ Parent | on HN ]

Re:Show HN: Digger – an Open Source Terraform automation and... by ljm on Sunday July 09, 2023 @05:24PM (#36659061)

I do similar with K8S and RBAC. The most common action in a repo is going to be to update a deployment with a new image or resource config, so that’s all it can do.

Still need a more permissive role to manage the cluster in other ways but you can isolate that and limit access to its repo.

[ Parent | on HN ]