Obfuscate secret values in .tfstate (e.g. aws_iam_access_key)

[ejoubaud]

If I use the aws_iam_access_key module to generate access keys, they end up stored in plain text in terraform.tfstate and there doesn't seem to be a way around that.

Input:

resource "aws_iam_user" "users" {
  count = "${var.user_count}"
  name = "${lookup(var.usernames, count.index)}"
  path = "/"
}

resource "aws_iam_access_key" "users" {
  count = "${var.user_count}"
  user = "${element(aws_iam_user.users.*.name, count.index)}"
}

And now in the tfstate I have (dummy example):

...
                "aws_iam_access_key.users.1": {
                    "type": "aws_iam_access_key",
                    "depends_on": [
                        "aws_iam_user.users"
                    ],
                    "primary": {
                        "id": "AKIAJFHRCD3RDG6S56IA",
                        "attributes": {
                            "id": "AKIAJFHRCD3RDG6S56IA",
                            "secret": "...",
                            "ses_smtp_password": "...",
                            "status": "Active",
                            "user": "myusername"
                        }
                    }
                },
...

Keeping those keys around in plain text should arguably not be encouraged, not be the default and not be a requirement. There should at least be a way to exclude them from the full text plan or somehow encrypt them.

[ejoubaud]

Also see related #4437

[jen20]

Hi @ejoubaud. Thanks for opening this issue! We have been aware of the need to deal with sensitive parts of the .tfstate for a while now - the first issue which addresses it is #516. It's also relevant to #1421. We have a major refactor here on the roadmap - for now we'll continue to update #516 as it develops, so I'll close this issue - if you'd like to track progress here please subscribe to #516! Thanks!

[ejoubaud]

Thanks @jen20, sorry I missed that one.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.