IaC Security - Terraform and Checkov

Protect Secrets in Terraform

### Never Hardcode Credentials in Provider Blocks ```hcl # BAD — credentials in code provider "aws" { access_key = "AKIAIOSFODNN7EXAMPLE" secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" region = "us-east-1" } # GOOD — use environment variables (Terraform picks these up automatically) # export AWS_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE" # export AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" provider "aws" { region = "us-east-1" } # BEST — use OIDC dynamic credentials in CI/CD (no static keys at all) # Covered in the OIDC section of the CI/CD module ``` ### Mark Sensitive Variables ```hcl # variables.tf variable "db_password" { description = "Database administrator password" type = string sensitive = true # Terraform redacts this in plan/apply output } variable "db_username" { description = "Database administrator username" type = string sensitive = true } ``` Pass values at runtime, not in code: ```bash # Option 1: Environment variables (picked up automatically by Terraform) export TF_VAR_db_password="$(aws secretsmanager get-secret-value \ --secret-id prod/db/password \ --query SecretString \ --output text)" # Option 2: .tfvars file (never commit to version control) echo 'db_password = "my-secure-password"' > secret.tfvars terraform apply -var-file="secret.tfvars" # .gitignore must include: # *.tfvars # terraform.tfvars ``` ### Mark Sensitive Outputs If you derive an output from a sensitive variable, Terraform will error unless you mark the output sensitive too: ```hcl # outputs.tf — BAD: Terraform will error on apply output "db_connection_string" { value = "postgresql://${var.db_username}:${var.db_password}@${aws_db_instance.main.endpoint}/app" } # GOOD: mark as sensitive output "db_connection_string" { value = "postgresql://${var.db_username}:${var.db_password}@${aws_db_instance.main.endpoint}/app" sensitive = true } ``` ### The State File Problem Marking variables as `sensitive` only redacts them from terminal output. The values are still stored in plain text in `terraform.tfstate`. Anyone with access to that file can read every secret. ```bash # This is why you must NEVER commit tfstate to git # Check your tfstate — secrets are visible in plain text: grep "password" terraform.tfstate # Output: "password": "my-secure-password" ``` The solution is remote state with encryption: ```hcl # backend.tf — store state in S3 with encryption and locking terraform { backend "s3" { bucket = "my-terraform-state-prod" key = "app/production/terraform.tfstate" region = "us-east-1" encrypt = true # AES-256 encryption at rest dynamodb_table = "terraform-state-lock" # State locking via DynamoDB kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/abc-123" } } ``` ```bash # Create the S3 bucket with versioning and encryption aws s3api create-bucket --bucket my-terraform-state-prod --region us-east-1 aws s3api put-bucket-versioning \ --bucket my-terraform-state-prod \ --versioning-configuration Status=Enabled aws s3api put-bucket-encryption \ --bucket my-terraform-state-prod \ --server-side-encryption-configuration \ '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}' # Block all public access to the state bucket aws s3api put-public-access-block \ --bucket my-terraform-state-prod \ --public-access-block-configuration \ "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true" # Create DynamoDB table for state locking aws dynamodb create-table \ --table-name terraform-state-lock \ --attribute-definitions AttributeName=LockID,AttributeType=S \ --key-schema AttributeName=LockID,KeyType=HASH \ --billing-mode PAY_PER_REQUEST ``` ### Use Ephemeral Resources for One-Time Credentials Terraform 1.10+ supports ephemeral resources — values that are used during a plan/apply but never stored in state: ```hcl # Generate a database password that is never stored in tfstate ephemeral "random_password" "db_password" { length = 24 special = false } resource "aws_secretsmanager_secret" "db_password" { name_prefix = "prod/db/password-" recovery_window_in_days = 7 } resource "aws_secretsmanager_secret_version" "db_password" { secret_id = aws_secretsmanager_secret.db_password.id secret_string_wo = jsonencode({ username = "admin", password = ephemeral.random_password.db_password.result }) } ``` ### Retrieve Secrets from Vault or Secrets Manager ```hcl # Retrieve database password from AWS Secrets Manager at apply time data "aws_secretsmanager_secret_version" "db_password" { secret_id = "prod/myapp/db-password" } resource "aws_db_instance" "main" { engine = "postgres" instance_class = "db.t3.micro" username = "admin" password = jsondecode(data.aws_secretsmanager_secret_version.db_password.secret_string)["password"] # ... } ``` ---