Dit deel is nog niet vertaald. Je ziet de Engelse tekst.
$ als gewone gebruiker# als root (of met sudo)
Vaardigheden in dit hoofdstuk
- Gevoelige data en secrets met Vault
Mark values as sensitive
sensitive = true hides a value in plan and apply output. It does not encrypt it in the state.
variable "db_admin_password" {
type = string
sensitive = true
}
output "connection_string" {
value = "postgres://admin:${var.db_admin_password}@${azurerm_postgresql_flexible_server.db.fqdn}/shop"
sensitive = true
}Keep secrets out of code
A secret must never be in a .tf or committed .tfvars file.
| Good place | How |
|---|---|
| Environment variable | export TF_VAR_db_admin_password=… (CI secret store) |
| HashiCorp Vault | vault_kv_secret_v2 data source, or dynamic secrets |
| Azure Key Vault | azurerm_key_vault_secret data source |
| Generated by Terraform | random_password → write it into Key Vault |
| HCP Terraform | Sensitive workspace variables |
resource "random_password" "db" {
length = 24
special = true
}
resource "azurerm_key_vault_secret" "db" {
name = "db-admin-password"
value = random_password.db.result
key_vault_id = azurerm_key_vault.main.id
}Read secrets from Vault
Vault stores secrets centrally, with access policies and audit logs. Terraform reads them with the Vault provider; dynamic secrets are created on demand and expire.
provider "vault" {
address = "https://vault.example.com:8200"
}
data "vault_kv_secret_v2" "db" {
mount = "secret"
name = "shop/db"
}
resource "azurerm_postgresql_flexible_server" "db" {
# ...
administrator_password = data.vault_kv_secret_v2.db.data["password"]
}Op het werk
Newer Terraform versions add ephemeral values and resources: secrets that are used during the run but never written to plan or state. Use them where your providers support them.
Protect the state
Because state can hold secrets, treat the state file like a password store.
- Use a remote backend with encryption at rest and access control (Azure Storage with RBAC, HCP Terraform).
- Turn on versioning / soft delete for the state container.
- Give write access to the state only to the pipeline identity.
- Never commit
*.tfstateto Git: add it to.gitignore.
.terraform/
*.tfstate
*.tfstate.*
*.tfvars
!example.tfvars
crash.logScan the code for security problems
Static scanners find insecure settings (public storage, open NSGs, no encryption) before apply.
trivy config .
checkov -d .
tflint --init && tflint| Tool | Checks |
|---|---|
| Trivy (config) | Misconfigurations in Terraform, Kubernetes, Dockerfiles |
| Checkov | Hundreds of cloud security policies |
| TFLint | Provider-specific errors and best practices |
Onthoud
Put the scan in the pipeline before plan. A failed scan stops the pull request.