Unlocking Terraform Secrets: A Step-by-Step Guide to Extracting Non-Sensitive Secrets and Setting Them as Environment Variables

As a Terraform user, you’re no stranger to the concept of secrets. But what happens when you need to access those secrets in your application or script? In this article, we’ll dive into the world of non-sensitive secrets in Terraform and show you how to extract them and set them as environment variables. Buckle up, and let’s get started!

What are Non-Sensitive Secrets in Terraform?

Before we dive into the process, let’s clarify what non-sensitive secrets are in Terraform. Simply put, non-sensitive secrets are values that are stored in your Terraform configuration files (`.tf` files) but don’t contain sensitive information like passwords, API keys, or encryption keys. These secrets might include configuration settings, database connections, or other environmental variables that your application needs to function.

Why Do We Need to Extract Non-Sensitive Secrets?

So, why do we need to extract these non-sensitive secrets? The main reason is to keep your Terraform configuration files clean and organized. By extracting these secrets, you can:

• Keep your Terraform files concise and focused on infrastructure provisioning
• Avoid cluttering your code with irrelevant variables
• Easily manage and update secrets without modifying your Terraform code
• Improve security by reducing the exposure of sensitive information

Step 1: Identify Non-Sensitive Secrets in Your Terraform File

The first step is to identify the non-sensitive secrets in your Terraform file. Open your `.tf` file and look for variables that meet the following criteria:

• They are not sensitive (e.g., passwords, API keys, encryption keys)
• They are not hardcoded values (e.g., IP addresses, port numbers)
• They are used by your application or script to function

For example, let’s say you have a Terraform file that provisions a PostgreSQL database:

resource "aws_db_instance" "example" {
  instance_class      = "db.t2.micro"
  engine               = "postgres"
  username             = "mydbuser"
  password             = "mydbpassword"
  db_name             = "mydb"
  vpc_security_group_ids = ["sg-0123456789abcdef0"]
}

variable "database_url" {
  type = string
  default = "postgresql://${aws_db_instance.example.username}:${aws_db_instance.example.password}@${aws_db_instance.example.endpoint}/${aws_db_instance.example.db_name}"
}

In this example, the `database_url` variable is a non-sensitive secret that can be extracted and set as an environment variable.

Step 2: Extract Non-Sensitive Secrets Using Terraform Output

Now that we’ve identified the non-sensitive secrets, let’s extract them using Terraform’s built-in output functionality. Terraform output allows you to print values to the console or save them to a file.

Update your Terraform file to include an output block for each non-sensitive secret:

output "database_url" {
  value = "postgresql://${aws_db_instance.example.username}:${aws_db_instance.example.password}@${aws_db_instance.example.endpoint}/${aws_db_instance.example.db_name}"
}

Run the following command to apply the changes and generate the output:

terraform apply

Terraform will apply the changes and print the output to the console:

Outputs:

database_url = postgresql://mydbuser:mydbpassword@mydb-1234567890abcdef0.us-east-1.rds.amazonaws.com:5432/mydb

Step 3: Save the Output to a File

Instead of printing the output to the console, we can save it to a file for later use. Create a new file named `output.txt` and update the output block to write the value to the file:

output "database_url" {
  value = "postgresql://${aws_db_instance.example.username}:${aws_db_instance.example.password}@${aws_db_instance.example.endpoint}/${aws_db_instance.example.db_name}"
  file  = "output.txt"
}

Run the following command to apply the changes and save the output to the file:

terraform apply

The output will be saved to the `output.txt` file:

$ cat output.txt
database_url = postgresql://mydbuser:mydbpassword@mydb-1234567890abcdef0.us-east-1.rds.amazonaws.com:5432/mydb

Step 4: Set the Non-Sensitive Secrets as Environment Variables

The final step is to set the non-sensitive secrets as environment variables. We’ll use the `output.txt` file to read the values and set them as environment variables using a script.

Create a new file named `set_env_vars.sh` with the following content:

#!/bin/bash

DB_URL=$(grep "database_url" output.txt | cut -d '=' -f2-)

export DATABASE_URL=$DB_URL
echo "DATABASE_URL=$DATABASE_URL"

# Add more environment variables as needed
# export VARIABLE_NAME=$(grep "variable_name" output.txt | cut -d '=' -f2-)
# echo "VARIABLE_NAME=$VARIABLE_NAME"

Make the script executable by running the following command:

chmod +x set_env_vars.sh

Run the script to set the environment variables:

./set_env_vars.sh

The script will read the values from the `output.txt` file and set them as environment variables:

$ echo $DATABASE_URL
postgresql://mydbuser:mydbpassword@mydb-1234567890abcdef0.us-east-1.rds.amazonaws.com:5432/mydb

Conclusion

And that’s it! You’ve successfully extracted non-sensitive secrets from your Terraform file and set them as environment variables. This approach not only keeps your Terraform files clean and organized but also improves security by reducing the exposure of sensitive information.

Remember to update your Terraform files and scripts to reflect the changes, and don’t hesitate to reach out if you have any questions or need further assistance.

Bonus Tips and Best Practices

Here are some additional tips and best practices to keep in mind:

Tips and Best Practices	Description
Use Terraform workspaces	Create separate Terraform workspaces for different environments (e.g., dev, prod) to keep secrets organized and isolated.
Use environment-specific variables	Use environment-specific variables (e.g., `db_username_dev`, `db_username_prod`) to avoid conflicts and improve security.
Store sensitive secrets securely	Store sensitive secrets in a secure location, such as a secrets manager (e.g., AWS Secrets Manager, HashiCorp Vault) or an encrypted file.
Avoid hardcoded values	Avoid hardcoded values in your Terraform files and instead use variables or secrets to improve security and flexibility.

By following these tips and best practices, you can ensure that your Terraform setup is secure, organized, and efficient.

Frequently Asked Question

Unlock the secrets of Terraform files and set them as environment variables with ease!