Secret management integration (Vault, Secrets Manager) in Terraform - Mini Project: Build & Apply

Secret management integration (Vault, Secrets Manager)

📖 Scenario: You are setting up a Terraform configuration to securely manage secrets for your cloud infrastructure. Instead of hardcoding sensitive information like API keys or passwords, you will integrate a secret management service to fetch these secrets dynamically.

🎯 Goal: Build a Terraform configuration that defines a secret in a secret manager and retrieves it securely for use in your infrastructure.

📋 What You'll Learn

Create a Terraform variable to hold the secret name

Configure the secret manager provider

Use a data source to fetch the secret value

Output the secret value securely without exposing it in plain text

💡 Why This Matters

🌍 Real World

Managing secrets securely is critical in cloud infrastructure to avoid exposing sensitive data like API keys or passwords in code repositories.

💼 Career

Cloud engineers and DevOps professionals often use Terraform with secret managers to automate secure infrastructure deployments.

1

Define a Terraform variable for the secret name

Create a Terraform variable called secret_name with the default value "my_api_key".

Terraform

# Define the secret_name variable
# Your code here

Need a hint?

Use the variable block with default set to "my_api_key".

2

Configure the AWS Secrets Manager provider

Add the provider block for AWS with the region set to "us-east-1".

Terraform

variable "secret_name" {
  type    = string
  default = "my_api_key"
}

# Configure AWS provider
# Your code here

Need a hint?

Use provider "aws" with region = "us-east-1".

3

Fetch the secret value using a data source

Add a data block named aws_secretsmanager_secret_version called secret that uses the secret_name variable to fetch the secret value.

Terraform

variable "secret_name" {
  type    = string
  default = "my_api_key"
}

provider "aws" {
  region = "us-east-1"
}

# Fetch secret value
# Your code here

Need a hint?

Use data "aws_secretsmanager_secret_version" "secret" with secret_id = var.secret_name.

4

Output the secret value securely

Add an output block named api_key that outputs the secret string from the data source secret.secret_string and mark it as sensitive = true.

Terraform

variable "secret_name" {
  type    = string
  default = "my_api_key"
}

provider "aws" {
  region = "us-east-1"
}

data "aws_secretsmanager_secret_version" "secret" {
  secret_id = var.secret_name
}

# Output the secret value securely
# Your code here

Need a hint?

Use an output block with sensitive = true and value from data.aws_secretsmanager_secret_version.secret.secret_string.