Skip to content

Instantly share code, notes, and snippets.

@ausmartway
ausmartway / provider.tf
Created October 15, 2021 11:19
secrets via env variables
provider "aws" {
region = "us-west-2"
}
@ausmartway
ausmartway / bash.sh
Created October 15, 2021 11:17
provider secrets in env
export AWS_ACCESS_KEY_ID=my_aws_access_key
export AWS_SECRET_ACCESS_KEY=my_aws_secret_key
@ausmartway
ausmartway / output.tf
Created October 15, 2021 11:15
getting tf variable value
output "aws_credentials" {
value = "aws_access_key=${var.aws_access_key}\naws_secret_key=${var.aws_secret_key}"
}
@ausmartway
ausmartway / provider.tf
Created October 15, 2021 11:11
provider credential by tf vars
provider "aws" {
region = "us-west-2"
access_key = var.aws_access_key
secret_key = var.aws_secret_key
}
@ausmartway
ausmartway / provider.tf
Created October 15, 2021 11:09
static provider secrets
provider "aws" {
region = "us-west-2"
access_key = "my_aws_access_key"
secret_key = "my_aws_secret_key"
}
@ausmartway
ausmartway / enforce-well-known-envvariables-sensitive.hcl
Last active October 15, 2021 11:05
enforce-well-known-envvariables-sensitive.sentinel
##tfe_variables that's not senstive can be read by anyone with access, this policies enforce well known enviroment variables to be sensitive.
import "tfplan/v2" as tfplan
# Get all tfe_variable resources
wellKnownEnvVariablesList = [
//aws
"AWS_SECRET_ACCESS_KEY",
"AWS_SESSION_TOKEN",
{
"mappings": {
"user_id": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
"email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
"name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
"given_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
"family_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
"upn": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn",
"groups": "http://schemas.xmlsoap.org/claims/Group"
},
➜ alicloud terraform11 apply -auto-approve
Error: alicloud_vswitch.alicloud_demo_vswitch: "availability_zone": required field is not set
Error: alicloud_vswitch.alicloud_demo_vswitch: "cidr_block": required field is not set
➜ alicloud export TF_LOG=DEBUG

Keybase proof

I hereby claim:

  • I am ausmartway on github.
  • I am yulei (https://keybase.io/yulei) on keybase.
  • I have a public key ASATNtdWvocMZw4u1mqY1yoSctM2Z_91BTZDjg4mFk4IkAo

To claim this, I am signing this object: