How can I insure that my retrieval of secrets is secure?

user_11271048 0
Viewed 405

Currently I am using Terraform and Aws Secrets Manager to store and retrieve secrets, and I would like to have some insight if my implementation is secure, and if not how can I make it more secure. Let me illustrate with what I have tried.

In secrets.tf I create a secret like (this needs to be implemented with targeting):

resource "aws_secretsmanager_secret" "secrets_of_life" {
  name = "top-secret"
}

I then go to the console and manually set the secret in AWS Secrets manager.

I then retrieve the secrets in secrets.tf like:

data "aws_secretsmanager_secret_version" "secrets_of_life_version" {
  secret_id = aws_secretsmanager_secret.secrets_of_life.id
}

locals {
  creds = jsondecode(data.aws_secretsmanager_secret_version.secrets_of_life.secret_string)
}

And then I proceed to use the secret (export them as K8s secrets for example) like:

resource "kubernetes_secret" "secret_credentials" {
  metadata {
    name      = "kubernetes_secret"
    namespace = kubernetes_namespace.some_namespace.id
  }
  data = {
    top_secret = local.creds["SECRET_OF_LIFE"]
  }
  type = "kubernetes.io/generic"
}

It's worth mentioning that I store tf state remotely. Is my implementation secure? If not, how can I make it more secure?

aws-secrets-manager terraform amazon-web-services
3 Answers

yes I can confirm it is secure since you accomplished the following:

  • plain text secrets out of your code.
  • Your secrets are stored in a dedicated secret store that enforces encryption and strict access control.
  • Everything is defined in the code itself. There are no extra manual steps or wrapper scripts required.
  • Secret manager support rotating secrets, which is useful in case a secret got compromised.

The only thing I can wonder about is using a Terraform backend that supports encryption like s3, and avoid commet the state file to your source control.

user_89059090

Looks good, as @asri suggests it a good secure implementation.

The risk of exposure will be in the remote state. It is possible that the secret will be stored there in plain text. Assuming you are using S3, make sure that the bucket is encrypted. If you share tf state access with other developers, they may have access to those values in the remote state file.

From https://blog.gruntwork.io/a-comprehensive-guide-to-managing-secrets-in-your-terraform-code-1d586955ace1

These secrets will still end up in terraform.tfstate in plain text! This has been an open issue for more than 6 years now, with no clear plans for a first-class solution. There are some workarounds out there that can scrub secrets from your state files, but these are brittle and likely to break with each new Terraform release, so I don’t recommend them.

user_54514920

Hi I'm working on similar things, here're some thoughts:

  1. when running Terraform for the second time, the secret will be in plain text in state files which are stored in S3, is S3 safe enough to store those sensitive strings?

  2. My work is using the similar approach: run terraform create an empty secret / dummy strings as placeholder -> manually update to real credentials -> run Terraform again to tell the resource to use the updated credentials. The thing is that when we deploy in production, we want the process as automate as possible, this approach is not ideal ut I haven't figure out a better way.

If anyone has better ideas please feel free to leave a comment below.

user_105819440
Related