Decrypt gcp credentials in terraform?

Question

I have a google cloud/terraform project wherein I'm using terraform to send files to a google cloud storage bucket. I have a json file of the service account credentials, that I've encrypted using cloud kms e.g.

gcloud kms encrypt \
    --key key \
    --keyring key-ring \
    --location location  \
    --plaintext-file file-with-data-to-encrypt \
    --ciphertext-file file-to-store-encrypted-data \
    | base64

However I want to use these encrypted crednetials in a terraform project e.g.

provider "google" {

  credentials = file( "ENCRYPTED-CREDS")

  project = var.project
  region  = "europe-west2"
}

My question is - how do I decrypt these credentials in terraform and/or use the encrypted credentials?

Daniel Ocando Daniel Ocando · Accepted Answer · 2021-02-05T23:37:05

Terraform includes a google_kms_secret data source to use the encrypted data with Cloud KMS within your resource definitions.

There is an example usage within the docs that you can use to base the steps to follow.

Basically you need to create a keyRing and a criptoKey resource.

Encrypt the json file using the gcloud command you mention and finally reference reference the encrypted ciphertext in your resource definitions.

The following section of the docs can also proof useful.

Decrypt gcp credentials in terraform?

2 Answers