Use env var for AWS credentials #1190
Conversation
It is not a best practice to hard code credentials into terraform.tfvars because there a high risk of leakage. This commit defaults to using default environment variables for AWS credentials. It also adds two more packages to remove when bootstrapping on a CHOST, without these two packages, containerd cannot be uninstalled, hence cloud-init does not complete. Also add the same values in the .example file as in the official documentation. Signed-off-by: lcavajani <lcavajani@suse.com> (cherry picked from commit 260a53a)
There was a problem hiding this comment.
Overall looks good to me, however I'm a bit conflicted... What I personally do is to define these variables inside of a secrets.auto.tfvars file, which is inside of my .gitignore.
@innobead : what is your opinion on this topic? AFAIK the Azure integration doesn't have the credentials stored inside of terraform at all, I know something got changed by your team recently.
|
|
|
@flavio this is a common practice to use environment variables and that's what we do with the other platforms so it would be consistent |
| export AWS_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE" | ||
| export AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" | ||
| export AWS_DEFAULT_REGION="eu-central-1" | ||
| set -o history | ||
| ``` | ||
|
|
||
| It can also be stored in a file, for example `aws-credentials` | ||
|
|
||
| ``` | ||
| AWS_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE" | ||
| AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" | ||
| AWS_DEFAULT_REGION="eu-central-1" |
There was a problem hiding this comment.
I would say let's just follow up the suggested ways provided by cloud providers like |
Why is this PR needed?
It is not a best practice to hard code credentials into
terraform.tfvarsbecause there a high risk of leakage.What does this PR do?
This commit defaults to using default environment variables for AWS credentials. Having these variables exported is also handy as it allows one to use
aws-clias well.It also adds two more packages to remove when bootstrapping on a
CHOST, without these two packages,containerdcannot be uninstalled, hencecloud-initdoes not complete.Anything else a reviewer needs to know?
Info for QA
Status BEFORE applying the patch
values must be hardcoded in
terraform.tfvarsStatus AFTER applying the patch
AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_DEFAULT_REGIONmust be exported before running terraform.Docs
SUSE/doc-caasp#903
Merge restrictions
(Please do not edit this)
We are in v4-maintenance phase, so we will restrict what can be merged to prevent unexpected surprises: