Patrick de Ruiter
696bffd023
Some checks failed
Code Quality & Security Scan / TFLint (push) Successful in 20s
Code Quality & Security Scan / Terraform Destroy (push) Has been skipped
Code Quality & Security Scan / Tfsec Security Scan (push) Successful in 23s
Code Quality & Security Scan / Checkov Security Scan (push) Successful in 37s
Code Quality & Security Scan / Terraform Validate (push) Successful in 35s
Code Quality & Security Scan / SonarQube Trigger (push) Successful in 38s
Code Quality & Security Scan / Terraform Plan (push) Failing after 25s
Code Quality & Security Scan / Terraform Apply (push) Has been skipped
Removed all hardcoded sensitive values from backend.tf: - MinIO endpoint URL - Bucket name - State file key/path - Access key and secret key Security Improvements: - Backend configuration now uses environment variables - Added comprehensive documentation for backend setup - Provided examples for both env vars and backend.hcl - Added backend.hcl to .gitignore to prevent credential leaks - Updated README with secure configuration instructions - Fixed step numbering in README after adding backend config section Backend Configuration Methods: 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) 2. Command-line flags during terraform init 3. Backend configuration file (backend.hcl) - now gitignored Breaking Change: - Users must now explicitly configure backend during terraform init - No default backend configuration provided for security reasons See README section 'Configure Backend (Optional)' for detailed setup instructions.
25 lines
979 B
HCL
25 lines
979 B
HCL
terraform {
|
|
backend "s3" {
|
|
# Backend configuration should be provided via:
|
|
# 1. Command-line flags during terraform init
|
|
# 2. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)
|
|
# 3. Backend config file
|
|
#
|
|
# Example init command:
|
|
# terraform init \
|
|
# -backend-config="endpoints={s3=\"https://minio.example.com:443\"}" \
|
|
# -backend-config="bucket=terraform-state" \
|
|
# -backend-config="key=docker/renovate/terraform.tfstate" \
|
|
# -backend-config="region=main" \
|
|
# -backend-config="skip_credentials_validation=true" \
|
|
# -backend-config="skip_metadata_api_check=true" \
|
|
# -backend-config="skip_requesting_account_id=true" \
|
|
# -backend-config="skip_region_validation=true" \
|
|
# -backend-config="use_path_style=true"
|
|
#
|
|
# Or use environment variables:
|
|
# export AWS_ACCESS_KEY_ID="your-access-key"
|
|
# export AWS_SECRET_ACCESS_KEY="your-secret-key"
|
|
}
|
|
}
|