Terraform and Terragrunt: Managing passwords and secrets

Learn how to manage secrets in terraform and terragrunt with environment variables exported from bash, and automate by using password managers with cli support to pass secrets to terraform.

Explore how cloud secret managers keep secrets outside Terraform, enabling secure read, rotation, and access control via cloud IAM, while noting costs, lack of Terraform tracking, and self-hosting limits.

Learn how HashiCorp Vault works with Terraform and Terragrunt to manage secrets externally, enabling rotation and centralized access control via UI, CLI, or API.

Encrypt secret files in a git repository using git-crypt for Terraform configurations, enabling commit-time encryption and decryption with GPG or a symmetric key. Discusses benefits and risks of this approach.

Encrypt secrets with AWS KMS and decrypt them for Terraform use, loading YAML and JSON secrets via data sources and keeping credentials hidden in the repository.

Learn how SOPs encrypt and decrypt secrets inside Terraform and Terragrunt, integrating with AWS KMS, vault, and PGP keys. Track changes with audit logs and keep keys visible in config.

Explore the base Terraform setup for provisioning an AWS RDS Postgres instance, focusing on securely handling db username and db password to avoid exposing credentials.

Explore the Terragrunt entry point, base environment, and module-driven setup for RDS, with include config and dynamic provider. Learn secret management options like secret manager, Vault, and git-crypt.

Learn how to manage secrets in Terraform by defining variables at the root level, exporting them as environment variables, and applying changes to modules while keeping sensitive values hidden.

Terragrunt demo teaches passing db credentials via environment variables instead of prompts. It shows Terragrunt invoking Terraform under the hood and keeping sensitive values hidden.

Create a symmetric AWS KMS key to encrypt and decrypt data for Terraform and Terragrunt workflows. Configure key usage, alias, labels, and administrator access, and plan regional deployment.

Explore an additional file approach using AWS Secrets Manager to fetch the DB username and password for Terraform, decoding the secret JSON and injecting it into main.tf.

Learn how to refactor a Terraform setup into a Postgres module with secret manager integration, using a secret id to fetch dynamic usernames and passwords across environments.

Learn how to manage passwords and secrets with Terragrunt using a secret manager backed module, reading credentials from the secret manager and passing them to a Postgres module.

Learn to install vault using the binary approach across macOS and Linux, via homebrew, system package managers, or direct binary downloads; verify, remove, and run the vault dev server.

Start a Vault dev server with the volt binary in development mode and not for production, retrieve the unseal key and root token, and compare non-docker, brew, and apt approaches.

Learn to run vault in development mode with Docker Compose, expose ports, initialize and unseal, and manage root and unseal tokens via setup and cleanup scripts.

Learn how to add secrets to vault using a key value engine v2, create a secret named db secrets with db_username and db_password, and prepare for Terraform integration.

Configure the vault provider in Terraform, read db credentials via a data source, and inject username and password from vault into main.tf, then run terraform apply.

Refactor Terraform by moving common data sources and locals into a Postgres module, then use the module with Terraform and Terragrunt to read secrets from Vault.

Configure vault integration in Terragrunt to fetch RDS secrets. Use a data source to retrieve the vault token and pass the db username and password to the RDS resource.

Install git-crypt from source on Linux and macOS by cloning repository and building with OpenSSL 3.0 flag, then use make and make install to place binary in /usr/local/bin and verify.

Install git-crypt with brew on macOS and Linux, verify the latest version, and note that apt is not the best approach, with Linux repositories to follow.

Install git-crypt on ubuntu using apt, compare the repository version with the latest from git, and choose official, unofficial, or brew routes for the binaries.

Learn how to use git-crypt for encryption and decryption of selected files, set up git attributes, generate keys, and unlock secrets for Terraform and Terragrunt workflows.

In this Terraform demo, learn to secure passwords with git crypt by encrypting secrets YAML, initializing a repository, setting git attributes, and decrypting data for module inputs.

Learn to use terragrunt with delta grant and git crypt to securely manage secrets in terraform workflows, including git attributes, secret yaml encryption, and decrypting before applying RDS resources.

Set up AWS kms keys for terraform and terragrunt secrets by creating a symmetric key for encrypting and decrypting data, with region-based key usage and permissions.

Encrypt and decrypt a secrets file using AWS KMS with Terraform and Terragrunt. Learn to manage ciphertext blobs and base64 decoding while avoiding plaintext commits.

Learn how to manage passwords and secrets in Terraform by decrypting an encrypted YAML file with AWS KMS, reading it via a data source, and injecting values into modules.

Refactor secret management by moving the secrets file into a dedicated module, decrypting it with an AWS KMS data source, and passing the secret file path as a variable.

Explore how to manage passwords and secrets with AWS KMS in Terragrunt, comparing plaintext file workflows to a secure KMS module approach for postgres deployments.

Install sops, the open source tool for encrypting data with Terraform and Terragrunt. Download a pre-built binary, place it in your path, and set execution permissions; checksum verification is optional.

Install sops using brew on Mac and Linux to manage passwords and secrets within a Terraform and Terragrunt environment.

Explore how sops integrates with AWS KMS to securely manage secrets for Terraform, encrypting a sample secret file, showing key visibility, and enabling multiple KMS keys and various CMS backends.

Explore sops with pgp by creating rsa key pairs, setting key ids via environment variables, and encrypting a secrets file without cloud, then decrypting with a passphrase.

Learn advanced sops usage with kms arn switches, key rotation, in-place encryption and decryption, and .sops.yaml creation rules to automate encryption for yaml and json files.

Demonstrate integrating sops with Terraform to securely decrypt and pass database credentials into a Terraform module, using a secrets file, provider setup, and a data source.

Explore using SOPs with AWS KMS in Terragrunt to encrypt and decrypt secrets, generating a secret file and injecting db username and password into Terraform variables.

Choose secrets management strategies based on team size, project scope, and budget, weighing file encryption and code-based options against vault or AWS Secrets Manager.

Celebrate completing the secrets in Terraform and Terragrunt course, thank you for learning, and invite feedback for future improvements.