Terraform, GitLab CI and Vault
Two articles on the same question from both ends: how does a pipeline get the credentials it needs without any of them being written down?
The first is the pipeline itself, authenticating to Vault with the JWT GitLab already issues and receiving AWS credentials that expire on their own. The second is the application the pipeline deploys, which has the same problem and solves it with Vault Agent.
The spoken version is a HashiTalks 2021 talk, on HashiCorp’s channel.
2021
- Secure your Terraform deployment on AWS with Gitlab-CI and Vault (application side) Retrieve database secrets from HashiCorp Vault on the application side of a GitLab CI deployment, with Vault Agent and JWT authentication.
- Terraform on AWS with GitLab CI and Vault: Dynamic Credentials (Pipeline Side) Give a GitLab CI pipeline short-lived AWS credentials from HashiCorp Vault through JWT authentication, so no Terraform deployment holds a static key.