Terraform RDS/RDS Cluster中master账号密码的安全存储方案咨询

Great question—keeping sensitive RDS credentials secure in Terraform is critical to avoid accidental exposure, especially when using version control like GitHub. Below are the most robust, industry-standard approaches for both master_username and master_password in your AWS RDS Cluster configuration.

Storing master_username #

While less sensitive than the password, hardcoding this value is still a bad habit. Use these methods instead:

• Terraform Input Variables: Define a variable for the username, then set it via command line or environment variables. This keeps it out of your codebase and makes it easy to adjust across environments.

  variable "rds_master_username" {
    type        = string
    description = "Master username for the RDS cluster"
  }
  
  resource "aws_rds_cluster" "default" {
    cluster_identifier = "aurora-cluster-demo"
    engine             = "aurora-mysql"
    availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"]
    database_name      = "mydb"
    master_username    = var.rds_master_username
    # ... other config
  }
  

  Set it with: terraform apply -var rds_master_username=foo or export TF_VAR_rds_master_username=foo before running Terraform.

Storing master_password (Critical Sensitive Data) #

This is where security matters most. Your current approach of replacing passwords with XXX before committing is error-prone—you might forget to swap it out, leading to accidental exposure. Here are the best alternatives:

1. AWS Secrets Manager (Recommended for AWS-Native Workflows) #

Store the password in Secrets Manager, then retrieve it using Terraform's data source. This enables password rotation, fine-grained access control, and ensures secrets never touch your code or Terraform state.

Example with automatic password generation:

# Generate a strong random password
resource "random_password" "rds_master" {
  length           = 16
  special          = true
  override_special = "!@#$%^&*()"
}

# Create a Secrets Manager secret to store the password
resource "aws_secretsmanager_secret" "rds_master_password" {
  name = "aurora-cluster-demo-master-password"
}

# Store the generated password in the secret
resource "aws_secretsmanager_secret_version" "rds_master_password" {
  secret_id     = aws_secretsmanager_secret.rds_master_password.id
  secret_string = jsonencode({ password = random_password.rds_master.result })
}

# Retrieve the password for the RDS cluster
data "aws_secretsmanager_secret_version" "rds_master_password" {
  secret_id = aws_secretsmanager_secret.rds_master_password.id
}

resource "aws_rds_cluster" "default" {
  cluster_identifier = "aurora-cluster-demo"
  engine             = "aurora-mysql"
  availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"]
  database_name      = "mydb"
  master_username    = var.rds_master_username
  master_password    = jsondecode(data.aws_secretsmanager_secret_version.rds_master_password.secret_string).password
}

2. Terraform Cloud/Enterprise Sensitive Variables #

If you use Terraform Cloud or Enterprise, store the master_password as a sensitive workspace variable. Terraform Cloud encrypts these values at rest and never exposes them in logs or state outputs. Just reference it in your code with var.rds_master_password.

3. Environment Variables with Sensitive Variables #

Mark the password variable as sensitive in Terraform, then set it via an environment variable. This keeps it out of your code, but ensure the environment variable is set securely (e.g., use your CI/CD pipeline's secret manager to inject it).

variable "rds_master_password" {
  type        = string
  description = "Master password for the RDS cluster"
  sensitive   = true # Hides the value in Terraform outputs and logs
}

resource "aws_rds_cluster" "default" {
  # ... other config
  master_password = var.rds_master_password
}

Set it with: export TF_VAR_rds_master_password=your-strong-password before running terraform apply.

4. HashiCorp Vault (For Multi-Cloud Teams) #

If your team uses HashiCorp Vault, store the password in a KV secret engine and retrieve it using Terraform's Vault provider. This is ideal for centralized secret management across multiple cloud platforms.

Key Takeaway #

Avoid hardcoding secrets at all costs. The methods above eliminate the risk of accidental commits and ensure your credentials are stored securely with proper access controls. Your current XXX workaround is risky—automated secret management is the way to go.

内容的提问来源于stack exchange，提问作者Julie