Guidance on Secret Management

[anuragkanungo]

Hi,

I am trying to use a secret in terraform stack yaml, but not able to determine what's the best way to handle it.

Here is what I have been trying:

1. Store the secret in SSM Parameter store as SecretString (default root/ssm store)
2. Accessing it via !store is not recommended, also it doesn't provide decrypted value in the variable.
3. Accessing it via gomplate datasource isn't working as I am not able to assume the root-planner role which has access to the ssm store

Not sure what I am missing but couldn't find much in the docs.

[milldr]

We recommend 1. Storing secrets for Terraform in AWS SSM Parameter Store as SecureString (with KMS) is secure, auditable, and works well across accounts if you need to share secrets.

!store on the other hand isn't intended for sensitive values. Values would be exposed to logs and could be compromised as a result.

Plus, we have a bit more on the decision designs for storing and placing secrets for Terraform here:

• Decide on Secrets Management Strategy for Terraform
• Decide on Secrets Placement for Terraform

[milldr]

More on this topic here as well: https://github.com/orgs/cloudposse/discussions/73

[anuragkanungo]

Thanks for the response.
How should I access the value stored in SSM? Gomplate datasource doesn't have a good assume role workflow.

[milldr]

We typically access SSM within Terraform and define where to find the parameter (path and account) with variables. Therefore you can set a common path and account (or this account) by default and override with stack configure as necessary

For example, here's a component for a grafana dashboard where pull the API key from SSM:
https://github.com/cloudposse-terraform-components/aws-managed-grafana-dashboard/blob/main/src/provider-grafana.tf#L31-L33

[milldr]

Here's another more advanced usage with a provider pulling the secret from another account:
https://github.com/cloudposse-terraform-components/aws-eks-argocd/blob/97ad1a6e88195636148620265e496aef7415cce1/src/data.tf#L20-L26

[anuragkanungo]

this makes sense, thank you!