How Secure are Your Sensitive Values in Terraform? Common Pitfalls of Scale Factory's Clients
summary
Shows concrete fixes: Terraform CLI generates a random password via the random provider, writes that credential into AWS Secrets Manager, and the state JSON still contains the plaintext password unless moved to a remote backend. Marks variables with sensitive = true (Terraform 0.14+) so the terminal redacts outputs, and moving the backend to Terraform Cloud stores state with encryption in transit and at rest. GPG state-encryption is deprecated.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker intro
- 3:34About Scale Factory and me
- 5:17Talk overview and goals
- 7:04Terraform workflow basics
- 11:20Secrets in code pitfalls
- 15:13State and lock file security
- 17:22Outputs and audit trails
- 20:10Demo setup and overview
- 24:01Demo: Sensitive value handling
- 27:15Demo: Terraform Cloud backend
- 29:06Key takeaways and conclusion
related talks
14mLightning Talk: 5 Security Tips for Terraform
32mGotchas Using Terraform in a Secure Delivery Pipeline
01h 00mGotchas using Terraform in a secure delivery pipeline
11mCommon Pitfalls When Using Terraform and How to Avoid Them
05mUsing Terraform Safely
08mLighting Talk: Lessons Learned from Writing Thousands of Lines of IaC
46mVault configuration as code via HashiCorp Terraform - Stories from trenches
14mIdentifying Misconfigurations in your Terraform