In AWS cloud formation I have some semblance of security in that when I provision a host with some credentials. (at least it appears as a bunch of asterices on the web console). But when I use a meta data script to provision a gcloud compute instance, I see my heretofore secure credentials in the
describe function and buried in the cloudinit logs in /run.
I can't find anything in the docs about this, which makes me think I'm doing something wrong from the ground up 1. This is a purpose built appliance based on linux that I am removing all the google tools on shortly after provisioning.
What I need is a way to pass in a username and password in a secure way so it gets picked up by cloud init (or whatever does the startup scripts after provisioning), but doesn't appear as plain text in the metadata. I can whack the logs in /run later.1 If there's no immediate solution, I'll probably move to short lived credentials (which is a better solution anyway), but that's a lot of work up front that I don't have time for right now (just mentioning that because I don't really need an alternate solution cooked up) if NO is the answer, that's fine!