search

runatlantis / atlantis

Terraform Pull Request Automation
https://www.runatlantis.io
Other
7.82k stars 1.06k forks source link

Secret Rotation for Atlantis in AWS #1938

Open fr3man1 opened 2 years ago

fr3man1 commented 2 years ago

Hello, What would be the best way to rotate secrets for Atlantis in AWS on ECS Fargate? I am currently using Atlantis with AzureDevOps Repos and Bitbucket Server. These two configurations require me either Stash API token and webhook, or a PAT. I am currently running atlantis on ECS and secrets manager is a native secrets store supported by ECS. The question is, if ENV variable changes value, does atlantis pick it up, or is container restart neccessary? Thanks

ddaws commented 2 years ago

The question is, if ENV variable changes value, does atlantis pick it up, or is container restart neccessary?

I think Atlantis will pickup the updated env vars as long as they area updated in the container, and whether they are updated in the container or not depends on how you are injecting them into the container at runtime, so this sounds like an AWS & ECS question, and not an Atlantis question.

When a secret is rotated in Secrets Manager is it updated in your container or do you need to restart the container? Can you restart the container automatically using an AWS lambda?