Closed abravosuse closed 2 years ago
@melzer-b1 What do you think? Could be implement another switch in terraform.tfvars
e.g. cleanup_secrets = true
which is disabled by default (to make debugging easier)?
@abravosuse #877 is a suggestion on how to implement this feature. Any other suggestions which files to e.g. delete?
@abravosuse #877 is a suggestion on how to implement this feature. Any other suggestions which files to e.g. delete?
It looks good to me, @yeoldegrove. Thanks!
implemented in #877
The variables and secrets set in the terraform.tfvars file are exposed in plain text file /etc/salt/grains, including master passwords. Even though folder /etc/salt can only be accessed by root or members of the salt group, this is a vulnerability and it would be preferable if the file was removed altogether at some point during the execution process.