{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/516","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/516/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/516/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/516/events","html_url":"https://github.com/hashicorp/terraform/issues/516","id":47036520,"number":516,"title":"Storing sensitive values in state files","user":{"login":"seanherron","id":297696,"avatar_url":"https://avatars.githubusercontent.com/u/297696?v=3","gravatar_id":"","url":"https://api.github.com/users/seanherron","html_url":"https://github.com/seanherron","followers_url":"https://api.github.com/users/seanherron/followers","following_url":"https://api.github.com/users/seanherron/following{/other_user}","gists_url":"https://api.github.com/users/seanherron/gists{/gist_id}","starred_url":"https://api.github.com/users/seanherron/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seanherron/subscriptions","organizations_url":"https://api.github.com/users/seanherron/orgs","repos_url":"https://api.github.com/users/seanherron/repos","events_url":"https://api.github.com/users/seanherron/events{/privacy}","received_events_url":"https://api.github.com/users/seanherron/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/terraform/labels/question","name":"question","color":"cc317c"},{"url":"https://api.github.com/repos/hashicorp/terraform/labels/thinking","name":"thinking","color":"fad8c7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":35,"created_at":"2014-10-28T15:02:12Z","updated_at":"2016-01-24T10:02:29Z","closed_at":null,"body":"#309 was the first change in Terraform that I could find that moved to store sensitive values in state files, in this case the `password` value for Amazon RDS. This was a bit of a surprise for me, as previously I've been sharing our state files publicly. I can't do that now, and feel pretty nervous about the idea of storing state files in version control at all (and definitely can't put them on github or anything).\r\n\r\nIf Terraform is going to store secrets, then some sort of field-level encryption should be built in as well. In the meantime, I'm going to change things around to use https://github.com/AGWA/git-crypt on sensitive files in my repos."},"comment":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/comments/174274382","html_url":"https://github.com/hashicorp/terraform/issues/516#issuecomment-174274382","issue_url":"https://api.github.com/repos/hashicorp/terraform/issues/516","id":174274382,"user":{"login":"apparentlymart","id":20180,"avatar_url":"https://avatars.githubusercontent.com/u/20180?v=3","gravatar_id":"","url":"https://api.github.com/users/apparentlymart","html_url":"https://github.com/apparentlymart","followers_url":"https://api.github.com/users/apparentlymart/followers","following_url":"https://api.github.com/users/apparentlymart/following{/other_user}","gists_url":"https://api.github.com/users/apparentlymart/gists{/gist_id}","starred_url":"https://api.github.com/users/apparentlymart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apparentlymart/subscriptions","organizations_url":"https://api.github.com/users/apparentlymart/orgs","repos_url":"https://api.github.com/users/apparentlymart/repos","events_url":"https://api.github.com/users/apparentlymart/events{/privacy}","received_events_url":"https://api.github.com/users/apparentlymart/received_events","type":"User","site_admin":false},"created_at":"2016-01-24T10:02:29Z","updated_at":"2016-01-24T10:02:29Z","body":"The reason to include it in the state file is to allow it to be interpolated into other values. For example, to create an RDS instance and then use the Postgres or MySQL provider to set up users and databases.\r\n\r\nCurrently Terraform depends on the state file for interpolations like this because the database resource (for example) might not be created in the same run as the RDS instance.\r\n\r\nOh course there are other ways to write the config such that you wouldn't depend on the state file to get the password, so it could well be interesting to have Terraform recognize such situations and only store the password when it is necessary. The UX for that would need to be figured out: it wouldn't do to silently add a password to the state file as a side effect of other config changes.\r\n\r\n"}}