In AWS cloud formation I have some semblance of security in that when I provision a host with some credentials. (at least it appears as a bunch of asterices on the web console). But when I use a meta data script to provision a gcloud compute instance, I see my heretofore secure credentials in the describe function and buried in the cloudinit logs in /run.

I can't find anything in the docs about this, which makes me think I'm doing something wrong from the ground up 1. This is a purpose built appliance based on linux that I am removing all the google tools on shortly after provisioning.

What I need is a way to pass in a username and password in a secure way so it gets picked up by cloud init (or whatever does the startup scripts after provisioning), but doesn't appear as plain text in the metadata. I can whack the logs in /run later.

1 If there's no immediate solution, I'll probably move to short lived credentials (which is a better solution anyway), but that's a lot of work up front that I don't have time for right now (just mentioning that because I don't really need an alternate solution cooked up) if NO is the answer, that's fine!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.