CODEWITHSUNDEEP
azureterraformazure-keyvault
patryk_ostrowski
patryk_ostrowski

Reputation: 237

Terraform: Adding sensitive data to Azure KeyVault

I am adding some sensitive data (for example password to existing sql server) to my Azure keyvault using Terraform. The problem is that this data are passed to Terraform in varaiables. I am using sensitive=true but still it can be readable in terraform file. The code will be stored in private Azure Devops repo but some other people will be able to see it. What is the best practice to keep it secure?

Upvotes: 0

Views: 1295

Answers (1)

RamaraoAdapa
RamaraoAdapa

Reputation: 3147

I have tested in my environment

By default, the values like key vault secrets are considered as sensitive by Terraform.

While running terraform plan command, you can see that key vault secret value as (sensitive)

But the problem is that these data can be seen in the variables.tf file. Whoever have the access to variables.tf file can see this sensitive data.

One way to fix this declaring the variable in the variables.tf without any default value.

Then while running terraform plan command, it will prompt to enter the key vault secret value and you can provide it.

However, entering values manually is time consuming and error prone.

Other way could be store these values in .tfvars file

But you need to limit the access of the .tfvars file

Reference: Protect Sensitive Input Variables | Terraform - HashiCorp Learn

Upvotes: 1

Related Questions