search

fpco / amber

Manage secret values in-repo via public key cryptography
MIT License
86 stars 9 forks source link

How do you think of this model for Terraform-alike? #20

Open Magicloud opened 3 years ago

Magicloud commented 3 years ago
  1. Having an IAM role only for CI/CD.
  2. At starting of the job, create some AWS secrets from Amber. Restrict them for CI/CD role.
  3. Running Terraform (using data to reference to the secrets).
  4. Succeeded or not, remove all secrets from AWS.

Hence we do not have AWS secrets for long term, and we do not have secret texts in Terraform artifacts.

snoyberg commented 3 years ago

Sorry, I'm not fully understanding the idea here.