How I Protect Secrets In Terraform Configurations

I have already touched on the importance of Terraform state in a previous post, but I wanted to expand on this from a security perspective. Let’s get this out the way now, Terraform stores secrets in its state file in plain text! There I said it. So how do I protect against secrets being revealed that could allow an attacker to compromise my systems? Well, I use a defence in depth strategy in a number of ways.Continue Reading...

How I Minimise Terraform Admin Effort & Manage The Constant Change

In a previous post I explained why I don’t advocate the use of child modules, but I wanted to quickly explain how I keep Terraform admin overhead to a minimum when creating standard resources whilst also working with the constant rate of change that cloud brings.

Continue Reading...

Use Of Terraform Child Modules

Terraform uses the construct of a module, which is defined by HashiCorp as “a set of Terraform configuration files in a single directory”. The root module consists of resources defined in the main working directory (which I like to refer to as the ’execution folder’). However, you can also call other modules to include their configuration. These are known as child modules which can be shared and reused by multiple root module configurations.Continue Reading...

How I Keep Terraform Simple

When writing a Terraform configuration, you want to keep all elements readable so whoever needs to interpret it in the future can easily understand the outcome the configuration deploys. This is how I do it.Continue Reading...

How To Generate JSON With Terraform Without Using Heredoc Strings

This is something I’ve only recently discovered but thought it was worth sharing here. I have a few configurations where I need to pass JSON to Terraform to process. The most used resource where I do this is azurerm_virtual_machine_extension. The example HashiCorp documentation still shows the use of Heredoc strings which is probably why I hadn’t picked up on it until now. I recently discovered a HashiCorp article where they tell you that by using the jsonencode and yamlencode functions “Terraform can be responsible for guaranteeing valid JSON or YAML syntax”.Continue Reading...

What I Include In Every Terraform Configuration

I use Terraform to create and manage Azure resources, and in order to do so in a structure and consistent manner there are a number of things that I always include in every configuration.Continue Reading...

How I Structure Terraform Folders & Apply Naming Standards

When I started using Terraform in 2018 the content online was mainly written from a developer’s perspective and was based on deploying resources into AWS. This was a great starting point, but the key messages in the blogs I read were all fairly consistent and seemed to align to the excellent blog series by Yevgeniy Brikman from 2016 which is well worth a read. So, I read the series, took all the key messages onboard and started deploying resources into Azure.Continue Reading...