Right Place at the Right Time With the Right Token
summary
Automates ephemeral credentials for Terraform workspaces using Terraform Cloud, HashiCorp Vault, Azure AD and AWS, with an ADO pipeline that calls the Terraform API to rotate per-workspace tokens on a schedule. Day‑zero automation creates app roles, policies and secrets backends; day‑one pipelines use a Vault provider module to fetch client IDs/secrets dynamically. Uses response wrapping and a cubbyhole token unwrap to avoid cleartext secret zero, logs everything to Splunk, sets 4–8 hour TTL and scales to hundreds or thousands of workspaces.
AI-written summary · about
chapters (12)
- 0:00State of the cloud analysis
- 2:03Identifying security challenges
- 3:51Developing a security model
- 5:54Human and organizational factors
- 7:48The Vault and Terraform journey
- 10:38Day zero landing zone setup
- 12:24Day one operations and workflows
- 14:48Separation of duties
- 16:30Vault configuration deep dive
- 19:39Implementation and registry
- 22:42Token rotation and security
- 27:18Expanding secret use cases
related talks
46mVault configuration as code via HashiCorp Terraform - Stories from trenches
31mHashiCorp Vault Configuration as Code via HashiCorp Terraform: Stories From the Trenches
24mSecrets at Scale with Vault and Waypoint
29mHow to get dynamic with secrets management
38mKeeping Secrets - A Practical Approach to Managing Credentials
55mBest practices
19mSynchronization of Infrastructure Provisioning & Application Deployments
50mTerraform 101: Building Repeatable, Secure Azure Infrastructure