Skip to content

Instantly share code, notes, and snippets.

@mnhat3896

mnhat3896/init-backend-results.md

Forked from neilpeterson/init-backend-results.md
Created April 26, 2021 03:36
Show Gist options
  • Save mnhat3896/49c2b21fa2aae0b66cfa62f4761b95d6 to your computer and use it in GitHub Desktop.
Save mnhat3896/49c2b21fa2aae0b66cfa62f4761b95d6 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @neilpeterson neilpeterson revised this gist Sep 15, 2018. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions init-backend-results.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,5 @@
    When initalizing a Terraform backend, a `.terraform/terraform.tfstate` file is written to disk and can include storage account secrets.

    ## Option 1

    Include the Azure Storage key in the Terraform configuration.
  2. @neilpeterson neilpeterson revised this gist Sep 15, 2018. 1 changed file with 3 additions and 6 deletions.
    9 changes: 3 additions & 6 deletions init-backend-results.md
    View file
    Original file line number Diff line number Diff line change
    @@ -77,7 +77,7 @@ terraform.tfstate file, key is visible.
    },
    ```

    ## Option 2
    ## Option 3

    Use partial configuration and put the Azure Storage access key in an environment variable named `ARM_ACCESS_KEY`.

    @@ -95,7 +95,7 @@ terraform {
    }
    ```

    Set environment variable (From Azure Key Vault):
    Furthermore, keep the access key out of terminal history with Azure Key Vault.

    ```
    ARM_ACCESS_KEY=$(az keyvault secret show --name tstate-key --vault-name billBooth --query value -o tsv)
    @@ -119,7 +119,4 @@ terraform.tfstate file, key is not visible.
    },
    "hash": 3693603136239683338
    },
    ```



    ```
  3. @neilpeterson neilpeterson revised this gist Sep 15, 2018. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions init-backend-results.md
    View file
    Original file line number Diff line number Diff line change
    @@ -2,7 +2,7 @@

    Include the Azure Storage key in the Terraform configuration.

    **Not ideal** - the Storage access key is exposed both in the configuration and in the `.terraform/terraform.tfstate` file.
    **Not ideal**: the Storage access key is exposed both in the configuration and in the `.terraform/terraform.tfstate` file.

    Configuration:

    @@ -42,7 +42,7 @@ terraform.tfstate file, key is visible.

    Use partial configuration and pass the Azure Storage key as a parameter to `terraform init`.

    **Not ideal** - The storage access key is still written to the `.terraform/terraform.tfstate` file.
    **Not ideal**: The storage access key is still written to the `.terraform/terraform.tfstate` file.

    Configuration:

    @@ -81,7 +81,7 @@ terraform.tfstate file, key is visible.

    Use partial configuration and put the Azure Storage access key in an environment variable named `ARM_ACCESS_KEY`.

    **Ideal** - The storage access key is not written to the .terraform/terraform.tfstate file.
    **Most ideal**: The storage access key is not written to the .terraform/terraform.tfstate file.

    Configuration:

  4. @neilpeterson neilpeterson revised this gist Sep 15, 2018. 1 changed file with 9 additions and 5 deletions.
    14 changes: 9 additions & 5 deletions init-backend-results.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,8 +1,8 @@
    ## Option 1

    **Option 1** - Include the Azure Storage key in the Terraform configuration.
    Include the Azure Storage key in the Terraform configuration.

    **Not ideal** - the Storage access key is exposed both in the configuration and in the .terraform/terraform.tfstate file.
    **Not ideal** - the Storage access key is exposed both in the configuration and in the `.terraform/terraform.tfstate` file.

    Configuration:

    @@ -38,9 +38,11 @@ terraform.tfstate file, key is visible.
    },
    ```

    **Option 2** - Use partial configuration and pass the Azure Storage key as a parameter to `terraform init`.
    ## Option 2

    **Not ideal** - The storage access key is still written to the .terraform/terraform.tfstate file.
    Use partial configuration and pass the Azure Storage key as a parameter to `terraform init`.

    **Not ideal** - The storage access key is still written to the `.terraform/terraform.tfstate` file.

    Configuration:

    @@ -75,7 +77,9 @@ terraform.tfstate file, key is visible.
    },
    ```

    **Option 2** - Use partial configuration and put the Azure Storage access key in an environment variable named `ARM_ACCESS_KEY`.
    ## Option 2

    Use partial configuration and put the Azure Storage access key in an environment variable named `ARM_ACCESS_KEY`.

    **Ideal** - The storage access key is not written to the .terraform/terraform.tfstate file.

  5. @neilpeterson neilpeterson revised this gist Sep 15, 2018. 1 changed file with 3 additions and 1 deletion.
    4 changes: 3 additions & 1 deletion init-backend-results.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,6 +1,8 @@
    ## Option 1

    **Option 1** - Include the Azure Storage key in the Terraform configuration.

    **Not ideal** becasue the Storage access key is exposed both in the configuration and in the .terraform/terraform.tfstate file.
    **Not ideal** - the Storage access key is exposed both in the configuration and in the .terraform/terraform.tfstate file.

    Configuration:

  6. @neilpeterson neilpeterson created this gist Sep 15, 2018.
    119 changes: 119 additions & 0 deletions init-backend-results.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,119 @@
    **Option 1** - Include the Azure Storage key in the Terraform configuration.

    **Not ideal** becasue the Storage access key is exposed both in the configuration and in the .terraform/terraform.tfstate file.

    Configuration:

    ```
    terraform {
    backend "azurerm" {
    storage_account_name = "tstate"
    container_name = "tstate"
    key = "terraform.tfstate"
    access_key = "<azure-storage-account-key>"
    }
    }
    ```

    Init command:

    ```
    terraform init
    ```

    terraform.tfstate file, key is visible.

    ```json
    "backend": {
    "type": "azurerm",
    "config": {
    "access_key": "<azure-storage-account-key>",
    "container_name": "tstate",
    "key": "terraform.tfstate",
    "storage_account_name": "tstate"
    },
    "hash": 13235237982197025795
    },
    ```

    **Option 2** - Use partial configuration and pass the Azure Storage key as a parameter to `terraform init`.

    **Not ideal** - The storage access key is still written to the .terraform/terraform.tfstate file.

    Configuration:

    ```
    terraform {
    backend "azurerm" {
    storage_account_name = "tstate"
    container_name = "tstate"
    key = "terraform.tfstate"
    }
    }
    ```

    Init command:

    ```
    terraform init -backend-config="access_key=<azure-storage-account-key>"
    ```

    terraform.tfstate file, key is visible.

    ```
    "backend": {
    "type": "azurerm",
    "config": {
    "access_key": "<azure-storage-account-key>",
    "container_name": "tstate",
    "key": "terraform.tfstate",
    "storage_account_name": "tstate"
    },
    "hash": 13235237982197025795
    },
    ```

    **Option 2** - Use partial configuration and put the Azure Storage access key in an environment variable named `ARM_ACCESS_KEY`.

    **Ideal** - The storage access key is not written to the .terraform/terraform.tfstate file.

    Configuration:

    ```
    terraform {
    backend "azurerm" {
    storage_account_name = "tstate"
    container_name = "tstate"
    key = "terraform.tfstate"
    }
    }
    ```

    Set environment variable (From Azure Key Vault):

    ```
    ARM_ACCESS_KEY=$(az keyvault secret show --name tstate-key --vault-name billBooth --query value -o tsv)
    ```

    Init command:

    ```
    terraform init
    ```

    terraform.tfstate file, key is not visible.

    ```
    "backend": {
    "type": "azurerm",
    "config": {
    "container_name": "tstate",
    "key": "terraform.tfstate",
    "storage_account_name": "tstate"
    },
    "hash": 3693603136239683338
    },
    ```