fix: mark secret app variables as sensitive #190
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Mark the secret app module variables as `sensitive` so that they are not leaked by the Terraform Plan action comment.
craigzour
approved these changes
Mar 22, 2022
⚠ Terrform update availableTerraform: 1.1.7 (using 1.0.10)
Terragrunt: 0.36.6 (using 0.35.6) |
Staging: app✅ Terraform Format: Plan: 1 to add, 6 to change, 1 to destroyShow planResource actions are indicated with the following symbols:
~ update in-place
-/+ destroy and then create replacement
<= read (data resources)
Terraform will perform the following actions:
# data.aws_iam_policy_document.forms_secrets_manager will be read during apply
# (config refers to values not yet known)
<= data "aws_iam_policy_document" "forms_secrets_manager" {
~ id = "3949306306" -> (known after apply)
~ json = jsonencode(
{
- Statement = [
- {
- Action = "secretsmanager:GetSecretValue"
- Effect = "Allow"
- Resource = [
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:token_secret-UyxxRR",
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:server-database-url-0PSpE3",
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:recaptcha_secret-spUZxB",
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:notify_api_key-nV4keR",
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:google_client_secret-tePLmK",
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:google_client_id-wRtgIh",
]
- Sid = ""
},
]
- Version = "2012-10-17"
}
) -> (known after apply)
- version = "2012-10-17" -> null
~ statement {
- not_actions = [] -> null
- not_resources = [] -> null
# (3 unchanged attributes hidden)
}
}
# data.aws_iam_policy_document.lambda_secrets will be read during apply
# (config refers to values not yet known)
<= data "aws_iam_policy_document" "lambda_secrets" {
~ id = "228793094" -> (known after apply)
~ json = jsonencode(
{
- Statement = [
- {
- Action = "secretsmanager:GetSecretValue"
- Effect = "Allow"
- Resource = [
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:token_secret-UyxxRR",
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:notify_api_key-nV4keR",
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:database-secret-vHJuTe",
]
- Sid = ""
},
]
- Version = "2012-10-17"
}
) -> (known after apply)
- version = "2012-10-17" -> null
~ statement {
- not_actions = [] -> null
- not_resources = [] -> null
# (3 unchanged attributes hidden)
}
}
# data.template_file.form_viewer_task will be read during apply
# (config refers to values not yet known)
<= data "template_file" "form_viewer_task" {
~ id = "d1f615ec3625dbb552253a3bcf9a2e3ccf82a72e98bdd1e68153242668335bae" -> (known after apply)
~ rendered = jsonencode(
[
- {
- environment = [
- {
- name = "METRIC_PROVIDER"
- value = "stdout"
},
- {
- name = "TRACER_PROVIDER"
- value = "stdout"
},
- {
- name = "SUBMISSION_API"
- value = "arn:aws:lambda:ca-central-1:687401027353:function:Submission"
},
- {
- name = "TEMPLATES_API"
- value = "arn:aws:lambda:ca-central-1:687401027353:function:Templates"
},
- {
- name = "ORGANIZATIONS_API"
- value = "arn:aws:lambda:ca-central-1:687401027353:function:Organizations"
},
- {
- name = "NEXTAUTH_URL"
- value = "https://forms-staging.cdssandbox.xyz"
},
- {
- name = "REDIS_URL"
- value = "gcforms-redis-rep-group.uwpetx.ng.0001.cac1.cache.amazonaws.com"
},
- {
- name = "RELIABILITY_FILE_STORAGE"
- value = "forms-staging-reliability-file-storage"
},
- {
- name = "RECAPTCHA_V3_SITE_KEY"
- value = "6LfJDN4eAAAAAGvdRF7ZnQ7ciqdo1RQnQDFmh0VY"
},
]
- image = "687401027353.dkr.ecr.ca-central-1.amazonaws.com/form_viewer_staging"
- linuxParameters = {
- capabilities = {
- drop = [
- "ALL",
]
}
}
- logConfiguration = {
- logDriver = "awslogs"
- options = {
- awslogs-group = "Forms"
- awslogs-region = "ca-central-1"
- awslogs-stream-prefix = "ecs-form-viewer"
}
}
- name = "form_viewer"
- portMappings = [
- {
- containerPort = 3000
},
]
- secrets = [
- {
- name = "NOTIFY_API_KEY"
- valueFrom = "arn:aws:secretsmanager:ca-central-1:687401027353:secret:notify_api_key-nV4keR"
},
- {
- name = "RECAPTACHA_V3_SECRET_KEY"
- valueFrom = "arn:aws:secretsmanager:ca-central-1:687401027353:secret:recaptcha_secret-spUZxB"
},
- {
- name = "GOOGLE_CLIENT_ID"
- valueFrom = "arn:aws:secretsmanager:ca-central-1:687401027353:secret:google_client_id-wRtgIh"
},
- {
- name = "GOOGLE_CLIENT_SECRET"
- valueFrom = "arn:aws:secretsmanager:ca-central-1:687401027353:secret:google_client_secret-tePLmK"
},
- {
- name = "DATABASE_URL"
- valueFrom = "arn:aws:secretsmanager:ca-central-1:687401027353:secret:server-database-url-0PSpE3"
},
- {
- name = "TOKEN_SECRET"
- valueFrom = "arn:aws:secretsmanager:ca-central-1:687401027353:secret:token_secret-UyxxRR"
},
]
},
]
) -> (known after apply)
# (2 unchanged attributes hidden)
}
# aws_ecs_task_definition.form_viewer must be replaced
-/+ resource "aws_ecs_task_definition" "form_viewer" {
~ arn = "arn:aws:ecs:ca-central-1:687401027353:task-definition/form-viewer:379" -> (known after apply)
~ container_definitions = jsonencode(
[
- {
- cpu = 0
- environment = [
- {
- name = "METRIC_PROVIDER"
- value = "stdout"
},
- {
- name = "NEXTAUTH_URL"
- value = "https://forms-staging.cdssandbox.xyz"
},
- {
- name = "ORGANIZATIONS_API"
- value = "arn:aws:lambda:ca-central-1:687401027353:function:Organizations"
},
- {
- name = "RECAPTCHA_V3_SITE_KEY"
- value = "6LfJDN4eAAAAAGvdRF7ZnQ7ciqdo1RQnQDFmh0VY"
},
- {
- name = "REDIS_URL"
- value = "gcforms-redis-rep-group.uwpetx.ng.0001.cac1.cache.amazonaws.com"
},
- {
- name = "RELIABILITY_FILE_STORAGE"
- value = "forms-staging-reliability-file-storage"
},
- {
- name = "SUBMISSION_API"
- value = "arn:aws:lambda:ca-central-1:687401027353:function:Submission"
},
- {
- name = "TEMPLATES_API"
- value = "arn:aws:lambda:ca-central-1:687401027353:function:Templates"
},
- {
- name = "TRACER_PROVIDER"
- value = "stdout"
},
]
- essential = true
- image = "687401027353.dkr.ecr.ca-central-1.amazonaws.com/form_viewer_staging"
- linuxParameters = {
- capabilities = {
- drop = [
- "ALL",
]
}
}
- logConfiguration = {
- logDriver = "awslogs"
- options = {
- awslogs-group = "Forms"
- awslogs-region = "ca-central-1"
- awslogs-stream-prefix = "ecs-form-viewer"
}
}
- mountPoints = []
- name = "form_viewer"
- portMappings = [
- {
- containerPort = 3000
- hostPort = 3000
- protocol = "tcp"
},
]
- secrets = [
- {
- name = "NOTIFY_API_KEY"
- valueFrom = "arn:aws:secretsmanager:ca-central-1:687401027353:secret:notify_api_key-nV4keR"
},
- {
- name = "RECAPTACHA_V3_SECRET_KEY"
- valueFrom = "arn:aws:secretsmanager:ca-central-1:687401027353:secret:recaptcha_secret-spUZxB"
},
- {
- name = "GOOGLE_CLIENT_ID"
- valueFrom = "arn:aws:secretsmanager:ca-central-1:687401027353:secret:google_client_id-wRtgIh"
},
- {
- name = "GOOGLE_CLIENT_SECRET"
- valueFrom = "arn:aws:secretsmanager:ca-central-1:687401027353:secret:google_client_secret-tePLmK"
},
- {
- name = "DATABASE_URL"
- valueFrom = "arn:aws:secretsmanager:ca-central-1:687401027353:secret:server-database-url-0PSpE3"
},
- {
- name = "TOKEN_SECRET"
- valueFrom = "arn:aws:secretsmanager:ca-central-1:687401027353:secret:token_secret-UyxxRR"
},
]
- volumesFrom = []
},
]
) -> (known after apply) # forces replacement
~ id = "form-viewer" -> (known after apply)
~ revision = 379 -> (known after apply)
tags = {
"CostCentre" = "forms-platform-staging"
"Terraform" = "true"
}
# (9 unchanged attributes hidden)
}
# aws_iam_policy.forms_secrets_manager will be updated in-place
~ resource "aws_iam_policy" "forms_secrets_manager" {
id = "arn:aws:iam::687401027353:policy/formsSecretsManagerKeyRetrieval"
name = "formsSecretsManagerKeyRetrieval"
~ policy = jsonencode(
{
- Statement = [
- {
- Action = "secretsmanager:GetSecretValue"
- Effect = "Allow"
- Resource = [
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:token_secret-UyxxRR",
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:server-database-url-0PSpE3",
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:recaptcha_secret-spUZxB",
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:notify_api_key-nV4keR",
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:google_client_secret-tePLmK",
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:google_client_id-wRtgIh",
]
- Sid = ""
},
]
- Version = "2012-10-17"
}
) -> (known after apply)
tags = {
"CostCentre" = "forms-platform-staging"
"Terraform" = "true"
}
# (4 unchanged attributes hidden)
}
# aws_iam_policy.lambda_secrets will be updated in-place
~ resource "aws_iam_policy" "lambda_secrets" {
id = "arn:aws:iam::687401027353:policy/lambda_secrets"
name = "lambda_secrets"
~ policy = jsonencode(
{
- Statement = [
- {
- Action = [
- "secretsmanager:GetSecretValue",
]
- Effect = "Allow"
- Resource = [
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:notify_api_key-nV4keR",
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:database-secret-vHJuTe",
- "arn:aws:secretsmanager:ca-central-1:687401027353:secret:token_secret-UyxxRR",
]
},
]
- Version = "2012-10-17"
}
) -> (known after apply)
tags = {
"CostCentre" = "forms-platform-staging"
"Terraform" = "true"
}
# (5 unchanged attributes hidden)
}
# aws_secretsmanager_secret_version.google_client_id will be updated in-place
~ resource "aws_secretsmanager_secret_version" "google_client_id" {
id = "arn:aws:secretsmanager:ca-central-1:687401027353:secret:google_client_id-wRtgIh|2FDD7625-F032-43DD-8291-53DF920EAB80"
+ secret_binary = (sensitive value)
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ secret_string = (sensitive value)
# (4 unchanged attributes hidden)
}
# aws_secretsmanager_secret_version.google_client_secret will be updated in-place
~ resource "aws_secretsmanager_secret_version" "google_client_secret" {
id = "arn:aws:secretsmanager:ca-central-1:687401027353:secret:google_client_secret-tePLmK|39A94A03-9A8B-446D-A76E-BD3568E12594"
+ secret_binary = (sensitive value)
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ secret_string = (sensitive value)
# (4 unchanged attributes hidden)
}
# aws_secretsmanager_secret_version.notify_api_key will be updated in-place
~ resource "aws_secretsmanager_secret_version" "notify_api_key" {
id = "arn:aws:secretsmanager:ca-central-1:687401027353:secret:notify_api_key-nV4keR|4A70C6E2-5060-443B-B912-2C95015CFD8D"
+ secret_binary = (sensitive value)
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ secret_string = (sensitive value)
# (4 unchanged attributes hidden)
}
# aws_secretsmanager_secret_version.recaptcha_secret will be updated in-place
~ resource "aws_secretsmanager_secret_version" "recaptcha_secret" {
id = "arn:aws:secretsmanager:ca-central-1:687401027353:secret:recaptcha_secret-spUZxB|4728F67E-99D4-4920-95E6-D4F67FA9986D"
+ secret_binary = (sensitive value)
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ secret_string = (sensitive value)
# (4 unchanged attributes hidden)
}
Plan: 1 to add, 6 to change, 1 to destroy.
─────────────────────────────────────────────────────────────────────────────
Saved the plan to: plan.tfplan
To perform exactly these actions, run the following command to apply:
terraform apply "plan.tfplan"
Show Conftest results17 tests, 17 passed, 0 warnings, 0 failures, 0 exceptions
|
This was referenced Sep 11, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Mark the secret app module variables as
sensitiveso that they are notleaked by the Terraform Plan action comment.