DevOps Bootcamp · Lesson

Secure Credential Management

Implement best practices for securely managing cloud provider credentials and sensitive data within your automated Terraform pipelines.

Secure Credential Management is a free DevOps Bootcamp lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Secure Credentials in CI/CD

When automating infrastructure with Terraform in a CI/CD pipeline, your pipeline needs access to cloud provider accounts. Managing these credentials securely is paramount to prevent unauthorized access and data breaches.

Think of it like giving a robot the keys to your house. You want to make sure only the right robot has the right keys, and those keys are protected.

Avoid Hardcoding Secrets

A common mistake is embedding sensitive information, like API keys or passwords, directly into your Terraform configuration files or CI/CD scripts. This is called hardcoding.

Security Risk: Secrets become part of your source code history (e.g., Git).
Exposure: Anyone with access to the repository can see them.
Maintenance: Changing a secret requires code modification and redeployment.

Environment Variables (Basic)

For local development or basic scenarios, environment variables are a simple way to provide credentials without hardcoding. You set them in your shell before running Terraform.

While better than hardcoding, this isn't ideal for shared CI/CD pipelines as secrets are still visible in logs or process lists if not handled carefully.

export AWS_ACCESS_KEY_ID="AKIA..."
export AWS_SECRET_ACCESS_KEY="abcdef..."
terraform plan

CI/CD Platform Secret Managers

Modern CI/CD platforms offer built-in secret management features. These allow you to store sensitive data securely within the platform itself, separate from your code repository.

When your pipeline runs, these secrets are injected into the build environment as environment variables or files, but they are never exposed in logs or stored in your repository.

GitHub Actions Secrets Example

GitHub Actions provides a dedicated section for repository secrets. You can add them via Settings > Secrets and variables > Actions > New repository secret.

In your workflow file, you can then reference these secrets using the secrets context. They are automatically masked in logs.

name: Deploy Infra
on: [push]
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@v1
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: us-east-1
    - name: Terraform Init
      run: terraform init

Cloud IAM Roles for Pipelines

The most secure approach for CI/CD authentication is to use Identity and Access Management (IAM) roles or service accounts provided by your cloud provider.

Instead of long-lived access keys, your CI/CD pipeline assumes a temporary role with specific permissions, often leveraging OpenID Connect (OIDC) for trust relationships. This eliminates the need to store static credentials entirely.

AWS IAM Role + OIDC Example

For AWS, you can configure an IAM Role that your GitHub Actions workflow can assume directly using OIDC. This means no AWS access keys are stored anywhere!

You define a trust policy for the role, allowing GitHub's OIDC provider to assume it based on specific conditions (e.g., repository, branch).

resource "aws_iam_role" "github_actions_role" {
  name = "github-actions-oidc-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Federated = "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
        }
        Action = "sts:AssumeRoleWithWebIdentity"
        Condition = {
          StringEquals = {
            "token.actions.githubusercontent.com:aud" : "sts.amazonaws.com"
          }
          StringLike = {
            "token.actions.githubusercontent.com:sub" : "repo:your-org/your-repo:*"
          }
        }
      }
    ]
  })
}

Terraform Sensitive Outputs

Sometimes, Terraform outputs might contain sensitive data, like database passwords or private keys. You should mark these outputs as sensitive.

When an output is marked sensitive, Terraform will redact its value in the CLI output and state file when displayed, helping prevent accidental exposure.

output "database_password" {
  value       = aws_db_instance.main.password
  description = "The database root password."
  sensitive   = true
}

Secure Credential Check

Which method is generally considered the most secure for CI/CD pipelines to authenticate with cloud providers, eliminating the need to store long-lived static credentials?

Recap: Secure Credentials

You've learned crucial strategies for managing sensitive data in your Terraform CI/CD pipelines:

Avoid Hardcoding: Never embed secrets directly in your code.
Leverage CI/CD Secrets: Use platform-specific secret managers for static credentials.
Embrace IAM Roles/OIDC: For ultimate security, use cloud provider IAM roles with OIDC to assume temporary permissions without storing keys.
Mark Sensitive Outputs: Protect sensitive data exposed by Terraform outputs.

These practices are vital for maintaining a robust and secure infrastructure.

Frequently asked questions

Is the “Secure Credential Management” lesson free?

Yes — the full text of “Secure Credential Management” is free to read here on the web, and the DevOps Bootcamp course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the DevOps Bootcamp course, upgrade to CoddyKit PRO.

What will I learn in “Secure Credential Management”?

Implement best practices for securely managing cloud provider credentials and sensitive data within your automated Terraform pipelines. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start DevOps Bootcamp?

No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Secure Credential Management” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this DevOps Bootcamp lesson?

Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to DevOps Bootcamp