How to avoid having plaintext master-passwords for RDS when deployed through terraform and How to retrieve password to use it in a server

Question

I'm new to stack overflow. Apologize if I didn't format it right. I'm currently using terraform to provision aurora-rds. Problem is, I shouldn't be having the db master-password as a plaintext sitting in the .tf file. I've been using this config initially with a plaintext password.

    engine          = "aurora-mysql"
    engine_version  = "5.7.12"
    cluster_family  = "aurora-mysql5.7"
    cluster_size    = "1"
    namespace       = "eg"
    stage           = "dev"
    admin_user      = "admin"
    admin_password  = "passwordhere"
    db_name         = "dbname"
    db_port         = "3306

I'm looking for a solution where I can skip a plaintext password like shown above and have something auto-generated and able to be included into terraform file. Also, I must be able to retrieve the password so that I can use that to configure wordpress server.

https://gist.github.com/smiller171/6be734957e30c5d4e4b15422634f13f4 I came across this solution but, not sure how to retrieve the password to use it in server. Well I haven't deployed this yet too.

You might want to check out Hashicorp's `Vault`. – rflume Jun 14 '19 at 21:37 — rflume, Jun 14 '19 at 21:37

score 1 · Accepted Answer · answered Jun 15 '19 at 07:18

1

As you mentioned in your question, there is a workaround, which you haven't yet tried.

I suggest to try that first and if its successful then to retrieve the password use output terraform resource.

output "db_password" {
  value = ${random_string.db_master_pass.result}
  description = "db password"
}

Once your terraform run is completed you can retrieve that value using terraform output db_password or if you want to refer that password somewhere in the terraform code itself then right away refer to that variable ${db_password}

answered Jun 15 '19 at 07:18

mchawre

10,744
4
35
57

6

While the solution above does not display the password in plain text in any Terraform output. It still displays it in your statefile. – HiTekHippy Oct 07 '20 at 16:03
1

It's not advised to do this. I suggest using AWS Secrets manager and 'random_password'. https://stackoverflow.com/a/69692526/13155217 – Bruno Schaatsbergen Oct 23 '21 at 22:31

How to avoid having plaintext master-passwords for RDS when deployed through terraform and How to retrieve password to use it in a server

1 Answers1