Secretless Terraform mostly

@ksatirli on Twitter and GitHub Developer Advocate at HashiCorp

@devops_rob on Twitter and GitHub Developer Advocate at HashiCorp

Agenda Adding Secrets to Vault Creating passwords with the Random Provider Consuming Secrets with Terraform Reading passwords with the Vault Provider Questions and Answers Ask us anything (related to Terraform and Vault)

⁄ Adding Secrets to HashiCorp Vault, using Terraform

Enabling a Secrets Engine vault:8200/ui/vault/settings/mount-secret-backend/

Enabling a Secrets Engine vault:8200/ui/vault/settings/mount-secret-backend/

Enabling a Secrets Engine vault:8200/ui/vault/secrets/secret/list

Environment TERMINAL > export VAULT_ADDR="https://vault:8200"

Environment TERMINAL > vault status Key Value --- ----- Seal Type shamir Initialized true Sealed false Total Shares 1 Threshold 1 Version 1.5.3 Cluster Name vault

Environment TERMINAL > vault login Token (will be hidden): Success! You are now authenticated.

Vault Provider CODE EDITOR provider "vault" { # Vault configuration is set via environment variables }

Generating Random Data CODE EDITOR resource "random_password" "pass" { length = 16 special = false } locals { pass = jsonencode({ "pass" : random_password.pass.result }) }

Writing Data to Vault CODE EDITOR resource "vault_generic_secret" "aws_db_instance" { path = "secret/aws_db_instance" data_json = local.pass }

Writing Data to Vault TERMINAL > terraform plan -out="provisioner.tfplan" Terraform will perform the following actions: # vault_generic_secret.aws_db_instance will be created + resource "vault_generic_secret" "aws_db_instance" { + data = (sensitive value) + data_json = (sensitive value) + disable_read = false + id = (known after apply) + path = "secret/aws_db_instance" } Plan: 1 to add, 0 to change, 0 to destroy.

Writing Data to Vault TERMINAL > terraform apply "provisioner.tfplan" vault_generic_secret.aws_db_instance: Creating... vault_generic_secret.aws_db_instance: Creation complete after 0s Apply complete! Resources: 1 added, 0 changed, 0 destroyed. The state of your infrastructure has been saved to the path below. This state is required to modify and destroy your infrastructure, so keep it safe. To inspect the complete state use the `terraform show` command. State path: terraform.tfstate

Writing Data to Vault TERMINAL Apply complete! Resources: 1 added, 0 changed, 0 destroyed. The state of your infrastructure has been saved to the path below. This state is required to modify and destroy your infrastructure, so keep it safe. To inspect the complete state use the `terraform show` command. State path: terraform.tfstate Outputs: instance_password = tx964n7QA2cD3xmi

Verifying Data in Vault vault:8200/ui/vault/secrets/secret/list

Verifying Data in Vault vault:8200/ui/vault/secrets/secret/show/aws_db_instance

⁄ Consuming Secrets with HashiCorp Terraform

Reading Data from Vault CODE EDITOR data "aws_vpc" "secretless_terraform" { } resource "aws_security_group" "secretless_terraform" { } resource "aws_security_group_rule" "allow_from_self" { }

Reading Data from Vault CODE EDITOR data "vault_generic_secret" "aws_db_instance" { path = "secret/aws_db_instance" version = 1 } resource "aws_db_instance" "secretless_terraform" { password = data.vault_generic_secret.pass.data["password"] }

Reading Data from Vault TERMINAL Terraform will perform the following actions: # aws_db_instance.secretless_terraform will be created + resource "aws_db_instance" "secretless_terraform" { + password = (sensitive value) } # aws_security_group.secretless_terraform will be created + resource "aws_security_group" "secretless_terraform" {} # aws_security_group_rule.allow_mysql_from_self will be created + resource "aws_security_group_rule" "allow_mysql_from_self" {} Plan: 3 to add, 0 to change, 0 to destroy.

Reading Data from Vault TERMINAL > terraform apply "consumer.tfplan" aws_security_group.secretless_terraform: Creating... aws_security_group.secretless_terraform: Creation complete aws_security_group_rule.allow_mysql_from_self: Creating... aws_security_group_rule.allow_mysql_from_self: Creation complete aws_db_instance.secretless_terraform: Creating... aws_db_instance.secretless_terraform: Creation complete Apply complete! Resources: 3 added, 0 changed, 0 destroyed. Outputs:

Reading Data from Vault TERMINAL Outputs: connection_string = \ mysql --host="instance.eu-west-2.rds.amazonaws.com" \ --port="3306" \ --user="devops" \ --password="tx964n7QA2cD3xmi"

Connecting to RDS TERMINAL mysql --host="instance.eu-west-2.rds.amazonaws.com" --port="3306" --user="devops" --password="tx964n7QA2cD3xmi" mysql: [Warning] Using a password on the command line interface can be insecure. Welcome to the MySQL monitor. Server version: 5.5.5-10.4.8-MariaDB Source distribution

Connecting to RDS TERMINAL mysql> SHOW DATABASES; +----------------------+ | Database | +----------------------+ | information_schema | | innodb | | mysql | | performance_schema | | secretless_terraform | | test | +----------------------+ 6 rows in set (0.10 sec)

Materials ▪ slides: speakerdeck.com/ksatirli/secretless-terraform ▪ code: github.com/ksatirli/secretless-terraform ▪ functions: hashi.co/tf-functions ▪ tutorials: hashi.co/tf-vault-tutorial ▪ forums: hashi.co/vault-forums

An online HashiCorp community experience October 12-15, 2020 US West daytime hours (PT)

Thank You rbarnes@hashicorp.com and kerim@hashicorp.com