Listen to this Post
One of the biggest complaints about Infrastructure as Code (IaC) tools like Terraform is that the state files they keep contain sensitive information, making them a goldmine for hackers. A recent change in Terraform addresses this issue with the of “write-only” attributes. With “write-only” attributes, values are used at runtime but are not saved in the Terraform state. This is particularly useful for sensitive data like database passwords. AWS has already implemented this feature for some cases, and it complements the “ephemeral” type introduced in Terraform 1.10.
You Should Know:
Here are some practical examples and commands to help you implement write-only attributes in Terraform:
1. Basic Example of Write-Only Attribute:
[hcl]
resource “aws_db_instance” “example” {
engine = “mysql”
instance_class = “db.t2.micro”
name = “exampledb”
username = “admin”
password = var.db_password # This is a write-only attribute
parameter_group_name = “default.mysql5.7”
}
variable “db_password” {
type = string
sensitive = true
}
[/hcl]
2. Using Ephemeral and Write-Only Together:
[hcl]
resource “aws_rds_cluster” “example” {
cluster_identifier = “example-cluster”
engine = “aurora-mysql”
master_username = “admin”
master_password = var.db_password # Write-only attribute
skip_final_snapshot = true
}
variable “db_password” {
type = string
sensitive = true
}
[/hcl]
3. Refreshing Terraform State:
terraform refresh
4. Initializing Terraform:
terraform init
5. Applying Changes:
terraform apply
6. Destroying Resources:
terraform destroy
What Undercode Say:
Terraform’s new write-only attributes are a significant step forward in securing sensitive data within IaC workflows. By ensuring that sensitive information like database passwords is not stored in the state file, Terraform reduces the risk of data breaches. Combining this with ephemeral attributes further enhances security. Here are some additional Linux and Windows commands that can be useful in managing your infrastructure securely:
- Linux Commands:
</li> </ul> <h1>Encrypt a file using GPG</h1> gpg -c sensitive_file.txt <h1>Decrypt a file using GPG</h1> gpg -d sensitive_file.txt.gpg > sensitive_file.txt <h1>Check for open ports</h1> netstat -tuln <h1>Monitor system logs</h1> tail -f /var/log/syslog
- Windows Commands:
</li> </ul> <h1>Encrypt a file using PowerShell</h1> Protect-File -Path "C:\sensitive_file.txt" -Algorithm AES <h1>Decrypt a file using PowerShell</h1> Unprotect-File -Path "C:\sensitive_file.txt" <h1>Check for open ports</h1> netstat -an <h1>Monitor system logs</h1> Get-EventLog -LogName System -Newest 10
For more detailed information, you can refer to the Terraform documentation and AWS RDS documentation.
References:
Reported By: Darryl Ruggles – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅Join Our Cyber World:
- Windows Commands:
