Secure Your Terraform Deploys in GitLab-CI with HashiCorp Vault
summary
Shows a working pipeline that uses GitLab-CI + Terraform + HashiCorp Vault in AWS to replace static AWS keys with dynamic AWS creds by having Vault assume per-account IAM roles, and to authenticate CI jobs via a JWT auth method bound to a specific GitLab project ID and master branch. Uses a Vault agent in runners and EC2 instances to auto-renew Vault tokens and secrets; demo deploys a PHP/MySQL app with a rotating DB user every minute to prove secrets issuance and renewal end-to-end.
AI-written summary · about
chapters (8)
- 0:00Introduction and context
- 2:52Problem with CI/CD secrets
- 5:19Vault dynamic secrets for AWS
- 7:07JWT authentication to Vault
- 9:18Vault agent and Terraform integration
- 12:12Application secret retrieval
- 16:10Live demonstration setup
- 23:27Summary and key takeaways
related talks
46mVault configuration as code via HashiCorp Terraform - Stories from trenches
30mHashiCorp Vault and Jenkins - Leveraging AWS IAM to Empower a Hybrid Scenario
23mFully SaaS-Based DevOps with Terraform Cloud and GitLab
25mIntegrating Vault with CI/CD pipelines: Best practices and pitfalls
38mDon’t Break Your Pasta! Good Practices for Securing Your Pipelines
31mHashiCorp Vault Configuration as Code via HashiCorp Terraform: Stories From the Trenches
38mKeeping Secrets - A Practical Approach to Managing Credentials
18mCodify Your JWT-OIDC Vault Auth Method with Terraform