HashiCorp Did It Backwards

Re:HashiCorp Did It Backwards by nijave on Wednesday September 06, 2023 @07:06AM (#37403495)

That's tricky since the state file frequently contains secrets. You can try to keep secrets out of the state file but that's largely provider/resource dependent. For instance, if you create an AWS RDS Postgres database, the state ends up containing the resource password. If you allow only plans, users can still access the password in the state file.

[ Parent | on HN ]

Re:HashiCorp Did It Backwards by joombaga on Wednesday September 06, 2023 @11:24AM (#37406503)

For RDS you can change the password after creating the DB, or use the SecretsManager integration. There are similar workarounds for other providers and resources. I use TF without storing secrets in the state file (providers: AWS, kubernetes, helm, onepassword, datadog, auth0, and more).

[ Parent | on HN ]

Re:HashiCorp Did It Backwards by macca321 on Thursday September 07, 2023 @08:23AM (#37417895)

You can exfiltrate secrets that aren't in the state, but are in accessible resources during a plan using an http data source with the secret encoded into the url

[ Parent | on HN ]