Feature request: create missing secrets

[gibbsoft]

Great plugin, thanks so much for writing this!

It would be really useful if the plugin could work something like this, although I'm not sure of the constraints of the data provider:

data "credstash_secret" "ssh_key" {
  name               = "ssh_key.public"
  command_if_missing = ["bash -x bin/generate_ssh_keypair.sh"]
}

This would mean that secrets wouldn't have to be preloaded into credstash, but could be dynamically created when required.

[tmichel]

This is an interesting idea. I think data sources are for read only data so if you want to create secrets that should be a terraform resource instead. I feel that hard coding a passwords in terraform config is not the best way to go about this but generating it on-demand could be viable approach.

Terraform stores everything in plain text in the state file. It is bad enough that sensitive data end up there as well so secrets retrieved by this provider are also leaked into the state. Putting passwords or any kind of secret in source control rubs me the wrong way so I'm hesitant about a feature that encourages this.

There are some really nice improvements coming in the next major release (hashicorp/terraform#11286) that could improve secrets handling in terraform.

[gibbsoft]

I agree. I like the idea that passwords and keys are created, stored and used dynamically without humans ever knowing what they are. The problem with using a resource to create the secret and also a data source to read it is that it's difficult to avoid a cyclic dependency, whereas if the data source fails upon lookup and passes off to a script, the script can create the missing secrets in credstash and output the newly generated data via stdout which can be captured and used as the value for the data source.

[tmichel]

I still think that if we ever add the ability to store secrets via this provider then that must be a terraform resource. It would make sense in some cases to accepts a value that is later stored in credstash. It would be pretty useful for AWS keys that are used for applications. That way you could generate them with terraform and store them in credstash without ever touching them or knowing their actual value.

[mrjavaguy]

I too would like someway to store secrets with Terraform.

[qrkourier]

I thought I needed this, but instead I used this approach to put a new version in the credential store whenever the resource is (re)created.

  user = "${aws_iam_user.internal.name}"

  provisioner "local-exec" {
    command = "credstash put -a internal_aws_secret_access_key ${aws_iam_access_key.internal.secret}"
  }

}

[vikas027]

@qrkourier - I think one benefit is that terraform (0.12) hides the sensitive stuff like passwords for us in plan/apply which command will not.