Manage Vault programmatically with Terraform
summary
Shows how Terraform plus the Vault provider v5 actually prevents secrets from leaking into plans and state by using ephemeral resources and write-only attributes. Uses Terraform to provision a KV v2 mount, a database secrets engine and a Postgres instance (launched via Docker), demonstrates cleartext passwords appearing in tf.plan and state before changes, then upgrades to Vault provider v5 and the values become hidden/null in plan and state, proving the approach works end to end.
AI-written summary · about
chapters (18)
- 0:00Introduction and agenda
- 1:03Terraform level set
- 3:08Why use Terraform with Vault
- 5:17Terraform Vault provider basics
- 7:20How Terraform interacts with Vault
- 8:02Terraform workflow overview
- 9:46Security concerns with secrets
- 11:08Introducing ephemeral values
- 13:06Hands-on lab setup
- 15:59Initial Terraform configuration
- 17:26Examining Terraform plan and state
- 19:14Applying Terraform configuration
- 20:40Updating to ephemeral values
- 25:38Verifying ephemeral value changes
- 27:28Security improvements with ephemeral values
- 27:50Vault CLI basics
- 29:37Self-guided challenges
- 31:21Prize draw and wrap-up
related talks
23mManaging Vault with Terraform
46mVault configuration as code via HashiCorp Terraform - Stories from trenches
31mHashiCorp Vault Configuration as Code via HashiCorp Terraform: Stories From the Trenches
25mSecuring and Scaling AWS with Terraform, Vault, and Veeam: A Practical Guide
42mHCP Vault Learn Lab: Operations with Terraform
51mIntroduction to Vault
28mOur Journey Into Secrets Management With Vault
18mForget About DB Credentials with Terraform, Vault and Kubernetes