How to pass HashiCorp Vault secrets(k/v passwords) to Terraform EC2 instance

Question

How can we pass HashiCorp Vault secrets, k/v username/password and feed Terraform while its creating Ec2 instance.

For example, i don't want to use in plain text

variable "myvariable" {
default = "mypassword"
}

Using token yea, but what resource should call Vault and ask for secrets which would be injected on creation time.

Answer 1

The simplest case is to use the Terraform Vault Provider (https://www.terraform.io/docs/providers/vault/index.html) - which, caveat, I've not used myself.

Example from the Terraform site:

provider "vault" {
  # It is strongly recommended to configure this provider through the
  # environment variables described above, so that each user can have
  # separate credentials set in the environment.
  #
  # This will default to using $VAULT_ADDR
  # But can be set explicitly
  # address = "https://vault.example.net:8200"
}

resource "vault_generic_secret" "example" {
  path = "secret/foo"

  data_json = <<EOT
{
  "foo":   "bar",
  "pizza": "cheese"
}
EOT
}

Optionally you can write a script in whatever language you are comfortable with to make the call out to Vault and invoke via local-exec in Terraform.

Example of invoking a simple command from the Terraform site:

resource "aws_instance" "web" {
  # ...

  provisioner "local-exec" {
    command = "echo ${aws_instance.web.private_ip} >> private_ips.txt"
  }
}