encrypt terraform state #24
Conversation
|
This is incorrect. We do need local backups of Terraform state. This is a disaster recovery measure. This about a scenario in which Consul cluster is broken or unavailable, but you need to manage the state of our cloud resources using Terraform, for example scale up. Without Consul that would not be doable, but with the backup available you could decrypt it and migrate to a local state to handle necessary changes even without Consul. |
|
Hmm In that case, I can encrypt the state backed up by terraform with consul's http token. |
siddarthkay
force-pushed
the
do-not-backup-tf-state
branch
from
6068723 to
aa3ccbe
Compare
There was a problem hiding this comment.
I tested it locally, works nicely. Two notes tho:
- I would move the decryption script to
infra-utils/ansibleand just reference it since it should be rarely needed. - The
ansible/README.mdshould updated in theInventorysection to explain the encrypted backup and how to decrypt.
| if view_only: | ||
| print(json.dumps(state, indent=2)) | ||
| else: | ||
| backup_path.write_text(json.dumps(state, indent=2)) |
There was a problem hiding this comment.
I would write the decrypted file to a new file, maybe terraform.tfstate.restored or something.
|
@jakubgs : One thing i worry about is if |
fixes: #2
Summary
CONSUL_HTTP_TOKEN