When you use a remote backend that needs authentication. HashrCorp recommends that you:

The correct answer is C. Use partial configuration to load the authentication credentials outside of the Terraform code. HashiCorp recommends using partial backend configuration to pass sensitive authentication credentials outside of your Terraform code. With partial configuration, you supply only non-sensitive backend settings in the .tf file and pass credentials at runtime via a separate…

Implement and maintain state

Question

Options

APush your Tefraform configuration to an encrypted git repository
BWrite the authentication credentials in the Terraform configuration files
CUse partial configuration to load the authentication credentials outside of the Terraform code
DKeep the Terraform configuration files in a secret store

How the community answered

(53 responses)

A
2% (1)
B
6% (3)
C
91% (48)
D
2% (1)

Explanation

HashiCorp recommends using partial backend configuration to pass sensitive authentication credentials outside of your Terraform code. With partial configuration, you supply only non-sensitive backend settings in the .tf file and pass credentials at runtime via a separate -backend-config file, environment variables, or CLI flags during 'terraform init'. This keeps secrets out of version control. Hardcoding credentials in configuration files (B) or storing the config in a secret store (D) does not solve the version-control exposure problem. Pushing to an encrypted git repo (A) still risks credential leakage.

Topics

#Remote Backend#Authentication#Security Best Practices#Partial Configuration

Community Discussion

No community discussion yet for this question.

Full TA-002-P Practice