Exclude *.tfvars files

[kevincloud]

Reasons for making this change:

Contrary to the current .gitignore explanation about .tfvars files, these are data points abtracted away from the Terraform variables due to the potentially sensitive nature of the values. For example, AWS, Azure, and GCP credentials are oftentimes assigned in the .tfvars files. I personally have had my credentials exposed several times due to the oversight of not excluding the .tfvars files in this particular .gitignore file.

The values in .tfvars files are, by nature, personal to the individual running the script. Data points such as these should not be included by default. If values are to be checked into version control, the variable definition includes a default attribute.

Links to documentation supporting these rule changes:

https://learn.hashicorp.com/terraform/getting-started/variables.html#from-a-file
https://www.linode.com/docs/applications/configuration-management/terraform/secrets-management-with-terraform/#keeping-secrets-out-of-tf-files
https://secrethub.io/blog/secret-management-for-terraform/#secrets-in-tfvars

If this is a new template:

• Link to application or project’s homepage:

Not new, just a slight but important change

[shiftkey]

I have no horse in this race, but I'll ask for feedback from the people who were involved with #2650 to see if they agree with the changes proposed...

cc @jkodroff @apparentlymart

[jkodroff]

@kevincloud You really don't want to put sensitive values in any TF file, vars or otherwise. Those values should come from environment variables.

[kevincloud]

Hi @jkodroff, I'm a Sr. Solutions Engineer at HashiCorp. Our official stance is that tfvars files should never be put into VCS. Users are given the choice of using tfvars files, environment variables, etc, and there are many valid reasons why users need to use tfvars files for secrets as opposed to environment variables. Environment variables actually take the lowest precendence for Terraform values.

[jkodroff]

Ok. That's good enough for me.

…

On Mon, Jul 6, 2020 at 3:21 PM Kevin Cochran ***@***.***> wrote: Hi @jkodroff <https://github.com/jkodroff>, I'm a Sr. Solutions Engineer at HashiCorp. Our official stance <https://www.terraform.io/docs/cloud/workspaces/variables.html#terraform-variables> is that tfvars files should never be put into VCS. Users are given the choice of using tfvars files, environment variables, etc, and there are many valid reasons why users need to use tfvars files for secrets as opposed to environment variables. Environment variables actually take the lowest precendence <https://www.terraform.io/docs/configuration/variables.html#variable-definition-precedence> for Terraform values. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#3452 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADEH5SMM5TPUUERZ4NERW3R2IP47ANCNFSM4OHZOAVA> .

[shiftkey]

Thanks for the contribution @kevincloud and the discussion @jkodroff!

[apparentlymart]

Please note that the advice @kevincloud linked to is specifically for Terraform Cloud/Enterprise and does not apply to folks using Terraform CLI directly. What I said in my previous comment still holds for the general case. It's a shame that the Terraform Cloud documentation is making assertions about usage of Terraform outside of Terraform Cloud.

In particular, my previous comment mentioned "if a particular user knows that .tfvars files are always generated in their environment", and from the Terraform Cloud docs we can see that indeed terraform.tfvars is always generated in that environment, and so it would make sense to .gitignore that file if you are using Terraform Cloud, but even in Terraform Cloud it's possible to check in other .tfvars files, include .auto.tfvars files, and have Terraform Cloud use them. (The Cloud documentation doesn't seem to make any specific recommendation about whether it's a good idea to do that, though.)

[jkodroff]

@shiftkey Oh no! Now I'm back on the fence! (@apparentlymart writes a lot of Terraform and I would not take his opinion lightly.)

[kevincloud]

Hi @apparentlymart, @jkodroff! Actually, if you read the reference for our official stance, the very last sentence in that section specifically calls out:

(Note that you shouldn't check in terraform.tfvars even when running Terraform solely on the command line.)

This is how we train our customers in our OSS workshops. As I mentioned before, the .tfvars files are designed to abstract values away from the code. If you want to check values into your repo with Terraform, use the default attribute in the variable definition. Or, you can add a terraform.tfvars.example file if you want to provide a template.

.tfvars files do not have the same context as, say, Java .properties files, where values are set post-build/post-compile. The Terraform code in your repo is production-ready. Many users have exposed sensitive data to the public by accidentally adding their .tfvars files to their repo. Because of that, they should never be checked in as the default option. Hence, the change to the .gitignore file.

[mikecmpbll]

I'm relatively new to this whole space, but I'm using Azure CAF supermodule and you configure it with tfvars, so near enough every file in my repo is a tfvars file. Is this a common pattern in terraform usage? If not, then no problem, but I found it weird when tfvars were gitignored using this gitignore file 🤷🏻 .