Sensitive Output #

# outputs.tf

output "database_password" {
  description = "Password database — dioper ke deployment pipeline via TF_VAR_*"
  value       = var.db_password
  sensitive   = true
}

output "rds_connection_string" {
  description = "Connection string lengkap untuk database production"
  value       = "postgresql://${var.db_username}:${var.db_password}@${aws_db_instance.main.endpoint}/${var.db_name}"
  sensitive   = true
}

output "api_credentials" {
  description = "Credential untuk API eksternal"
  sensitive   = true
  value = {
    key    = var.api_key
    secret = var.api_secret
    url    = aws_apigatewayv2_api.main.api_endpoint
  }
}

# APA YANG DILINDUNGI oleh sensitive = true:

terraform output
# Outputs:
# database_password = <sensitive>    ← tersembunyi di terminal
# instance_public_ip = "54.123.45.67"

terraform apply
# ... (output sensitive tidak ditampilkan di log apply)

terraform plan
# ... (nilai sensitive tidak tampil di diff)

# APA YANG TIDAK DILINDUNGI:

# 1. Nilai masih tersimpan plaintext di state file
cat terraform.tfstate | grep -A5 '"database_password"'
# "value": "super-secret-password-123"  ← MASIH BISA DIBACA

# 2. Masih bisa diakses via terraform output -raw
terraform output -raw database_password
# super-secret-password-123  ← TAMPIL jika diakses secara eksplisit

# 3. Masih bisa diakses via terraform output -json
terraform output -json
# { "database_password": { "value": "super-secret-password-123", ... } }

variable "db_password" {
  type      = string
  sensitive = true
}

resource "aws_db_instance" "main" {
  password = var.db_password  # Nilai sensitive "merambat" ke resource ini
}

# Di output plan, atribut password pada resource ini
# akan ditampilkan sebagai (sensitive value) bukan nilai aslinya:
#
# ~ resource "aws_db_instance" "main" {
#     ~ password = (sensitive value)
#   }

# STRATEGI 1: Jangan generate credential di Terraform jika bisa dihindari
# Biarkan secrets manager yang mengelola dan merotasi credential

# ANTI-PATTERN: Generate password di Terraform
resource "random_password" "db" {
  length  = 16
  special = true
}

resource "aws_db_instance" "main" {
  password = random_password.db.result
  # Password tersimpan di state — siapapun akses state bisa baca password
}

# BENAR: Biarkan RDS manage password sendiri (AWS Secrets Manager rotation)
resource "aws_db_instance" "main" {
  manage_master_user_password = true
  # Password dikelola AWS Secrets Manager, tidak ada di state Terraform
}

# STRATEGI 2: Baca secret dari secrets manager, jangan generate
data "aws_secretsmanager_secret_version" "db" {
  secret_id = "production/myapp/database"
}

locals {
  db_creds = jsondecode(data.aws_secretsmanager_secret_version.db.secret_string)
}

resource "aws_db_instance" "main" {
  username = local.db_creds.username
  password = local.db_creds.password
  # Secret tidak di-generate Terraform, tidak "dimiliki" Terraform
  # Terraform hanya membaca dan menggunakannya
}

# STRATEGI 3: Output hanya apa yang perlu, bukan seluruh credential
# Daripada output password langsung, output referensi ke secrets manager

output "db_secret_arn" {
  description = "ARN secret di Secrets Manager — gunakan ini untuk akses credential"
  value       = aws_secretsmanager_secret.db.arn
  # Tidak perlu sensitive — ARN bukan credential, hanya referensi ke credential
}

# Aplikasi/pipeline yang butuh credential akan akses Secrets Manager langsung
# menggunakan ARN ini, bukan membacanya dari Terraform output

# Cek apakah ada nilai sensitive yang tersimpan di state
terraform state pull | python3 -c "
import json, sys
state = json.load(sys.stdin)
for resource in state.get('resources', []):
  for instance in resource.get('instances', []):
    attrs = instance.get('attributes', {})
    for key, val in attrs.items():
      if any(keyword in key.lower() for keyword in ['password', 'secret', 'key', 'token']):
        print(f\"{resource['type']}.{resource['name']}: {key} = ***\")
"

# Batasi akses ke state dengan IAM policy (S3 backend)
resource "aws_iam_policy" "terraform_state_read" {
  name = "terraform-state-read"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = ["s3:GetObject", "s3:ListBucket"]
        Resource = [
          aws_s3_bucket.terraform_state.arn,
          "${aws_s3_bucket.terraform_state.arn}/*"
        ]
        # Batasi ke principal yang memang butuh akses state
      }
    ]
  })
}