title: Referencing gitlab secrets in Terraform
body: <p>I am quite new to Terraforms and gitlab CI and there is something that I am trying to do here with it. </p>
  
  <p>I want to use Terraform to create an IAM user and a S3 bucket. Using policies allow certain operations on this S3 bucket to this IAM user. Have the IAM user's credentials saved in the artifactory. 
  Now the above is going to be my core module. </p>
  
  <p>The <em>core module</em> looks something like the below: </p>
  
  <p>Contents of : <strong>aws-s3-iam-combo.git</strong></p>
  
  <p>(The credentials for the IAM user using which all the Terraform would be run, say <em>admin-user</em>, would be stored in gitlab secrets.)</p>
  
  <p><code>main.tf</code></p>
  
  <pre><code>resource "aws_s3_bucket" "bucket" {
    bucket = "${var.name}"
    acl = "private"
    force_destroy = "true"
  
    tags {
      environment = "${var.tag_environment}"
      team        = "${var.tag_team}"
    }
  
    policy =&lt;&lt;EOF
  {
    "Version": "2008-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "AWS": "${aws_iam_user.s3.arn}"
        },
        "Action": "s3:*",
        "Resource": [
          "arn:aws:s3:::${var.name}",
          "arn:aws:s3:::${var.name}/*"
        ]
      }
    ]
  }
  EOF
  }
  
  resource "aws_iam_user" "s3" {
    name = "${var.name}-s3"
    force_destroy = "true"
  }
  
  resource "aws_iam_access_key" "s3" {
    user = "${aws_iam_user.s3.name}"
  }
  
  resource "aws_iam_user_policy" "s3_policy" {
    name = "${var.name}-policy-s3"
    user = "${aws_iam_user.s3.name}"
    policy =&lt;&lt;EOF
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "s3:*",
        "Resource": [
          "arn:aws:s3:::${var.name}",
          "arn:aws:s3:::${var.name}/*"
        ]
      }
    ]
  }
  EOF
  }
  </code></pre>
  
  <p><code>outputs.tf</code></p>
  
  <pre><code>output "bucket" {
    value = "${aws_s3_bucket.bucket.bucket}"
  }
  
  output "bucket_id" {
    value = "${aws_s3_bucket.bucket.id}"
  }
  
  output "iam_access_key_id" {
    value = "${aws_iam_access_key.s3.id}"
  }
  
  output "iam_access_key_secret" {
    value = "${aws_iam_access_key.s3.secret}"
  }
  </code></pre>
  
  <p><code>variables.tf</code></p>
  
  <pre><code>variable "name" {
    type = "string"
  }
  
  variable "tag_team" {
    type = "string"
    default = ""
  }
  
  variable "tag_environment" {
    type = "string"
    default = ""
  }
  
  variable "versioning" {
    type = "string"
    default = false
  }
  
  variable "profile" {
    type = "string"
    default = ""
  }
  </code></pre>
  
  <p>Anyone in the organization who now needs to create S3 buckets, would need to create a new repo, something of the form:</p>
  
  <p><code>main.tf</code></p>
  
  <pre><code>module "aws-s3-john-doe" {
    source = "git::https://git@gitlab-address/terraform/aws-s3-iam-combo.git?ref=v0.0.1"
    name = "john-doe"
    tag_team = "my_team"
    tag_environment = "staging"
  }
  </code></pre>
  
  <p><code>gitlab-ci.yml</code></p>
  
  <pre><code>stages:
    - plan
    - apply
  
  plan:
    image: hashicorp/terraform
    stage: plan
    script:
      - terraform init
      - terraform plan
  
  apply:
    image: hashicorp/terraform
    stage: apply
    script:
      - terraform init
      - terraform apply
    when: manual
    only:
      - master
  </code></pre>
  
  <p>And then the pipeline would trigger and when this repo gets merged to master, the resources (S3 and IAM user) would be created and the user would have this IAM user's credentials. </p>
  
  <p>Now the problem is that we have multiple AWS accounts. So say if a dev wants to create an S3 in a certain account, it would not be possible with the above set up as the <em>admin-user</em>, whose creds are in gitlab secrets, is only for one account alone. </p>
  
  <p>Now I don't understand how do I achieve the above requirement of mine. I have the below idea: (Please suggest if there's a better way to do this)</p>
  
  <ol>
  <li>Have multiple different creds set up in gitlab secrets for each AWS account in question</li>
  <li>Take user input, specifying the AWS account they want the resources created in, as a variable. So something like say:</li>
  </ol>
  
  <p><code>main.tf</code></p>
  
  <pre><code>module "aws-s3-john-doe" {
    source = "git::https://git@gitlab-address/terraform/aws-s3-iam-combo.git?ref=v0.0.1"
    name = "john-doe"
    tag_team = "my_team"
    tag_environment = "staging"
    aws_account = "account1"
  }
  </code></pre>
  
  <ol start="3">
  <li>And then in the <strong>aws-s3-iam-combo.git</strong> <code>main.tf</code> somehow read the creds for <em>account1</em> from the gitlab secrets.</li>
  </ol>
  
  <p>Now I do not know how achieve the above, like how do i read from gitlab the required secret variable etc. </p>
  
  <p>Can someone please help here?</p>