Using Vault to encrypt remote Terraform state stored in Consul

user_8950437 0
Viewed 726

As of today, managing secrets such as cloud provider access keys and ids is an open problem in the Terraform project (see github issue ). Whenever, we run terraform plan or terraform apply, these secrets are stored in plain text in the terraform state file. There are numerous third party redaction and encryption scripts such as terrahelp.

My question: Consul is a native backend for storing remote terraform state. Is it possible to use Vault to encrypt state files stored in Consul? I have tried searching through the Terraform backend documentation, but was not able to find any configuration flags that would allow Consul to use Vault to encrypt the state file.

consul hashicorp-vault terraform devops
1 Answers

As much as I would like that feature, sadly I don't think that this is possible at the moment. If you want your whole statefile encrypted, then you would need to choose another backend that supports this out of the box, like s3 with bucket encryption enabled.

It would also be nice if there is an official way to hook into the statefile read/store procedure to incorporate vault encryption (or any other custom requirements) by yourself, but afaik this is also not possible.

Small site note: terraform plan does not write anything to the statefile. It is a read-only operation, as otherwise it couldn't be considered safe to use.

user_44784200
Related