How to hide sensitive variables from datasource ina a local-exec provider

user_15228506 0
Viewed 602

I am trying to initialize a database using a docker image with a local provider.

resource "null_resource" "db_setup" {

  provisioner "local-exec" {

    command = <<EOT
        docker run \
        -e DB_CONNECTION="mysql" \
        -e DB_HOST=${module.mysql_others.endpoint} \
        -e DB_DATABASE=${data.aws_ssm_parameter.DATABASE.value} \
        -e DB_USERNAME=${data.aws_ssm_parameter.USERNAME.value} \
        -e DB_PASSWORD=${data.aws_ssm_parameter.PASSWORD.value} \
        random_docker_image:latest \
        ./database_seed
    EOT        

  }
}

I am getting all the comand in clear text when I terraform apply it. Is there any way of avoid it?

terraform-provider-aws terraform
1 Answers

You could use sensitive function with locals to "mark" variable as sensitive.

locals {
  sensitive_db_password = sensitive(data.aws_ssm_parameter.PASSWORD.value)
}

resource "null_resource" "db_setup" {
  provisioner "local-exec" {
    command = <<EOT
            docker run \
        -e DB_CONNECTION="mysql" \
        -e DB_HOST=${module.mysql_others.endpoint} \
        -e DB_DATABASE=${data.aws_ssm_parameter.DATABASE.value} \
        -e DB_USERNAME=${data.aws_ssm_parameter.USERNAME.value} \
        -e DB_PASSWORD=${local.sensitive_db_password} \
        random_docker_image:latest \
        ./database_seed
    EOT
  }
}

Output will be suppressed.

Documentation : https://www.terraform.io/language/functions/sensitive

user_2957160
Related