Video of presentation: https://www.hashicorp.com/resources/security-in-depth-terraform-vault Ever wondered how you can combine infrastructure and secrets management into one automated flow? Terraform and Vault, two open source tools from HashiCorp can make this simple, providing a security in depth approach for your DevOps teams. Dave Arnold of HashiCorp's solutions engineering team will give a technical deep-dive and demo of Vault with Terraform. After the 15 minute demo, we take live questions from the audience.

1. Copyright © 2017 HashiCorp
Security in Depth
with Terraform and
Vault

2. Copyright © 2017 HashiCorp
▪ Develop basic principles for securing terraform state
▪ Discuss secrets generation and management with Terraform
▪ Showcase Dynamic Secrets Engines with Vault
▪ Demonstrate Vault/Terraform Integrations
Agenda
!2

3. Copyright © 2017 HashiCorp
Secure Your Data

4. Copyright © 2017 HashiCorp !4
Terraform State
can contain
Sensitive Data

5. Copyright © 2017 HashiCorp !5
You can use a .gitignore
file to ignore files that
are generated by
Terraform.
Prevent state
check-in…

6. Copyright © 2017 HashiCorp !6
Encrypt your state
files…

7. Copyright © 2017 HashiCorp
▪ Dont check your state files into source code
repositories.
▪ Use an encrypted backend.
!7
Playing it safe…

8. Copyright © 2017 HashiCorp
Securing Access to
Infrastructure

9. Copyright © 2017 HashiCorp !9
We can generate
credentials using
Terraform…

10. Copyright © 2017 HashiCorp !10
There a number of
resources in Terraform that
require credentials to be
configured when
provisioned. These can be
dynamically generated by
Terraform.
We can use them
to provision
infrastructure…

11. Copyright © 2017 HashiCorp !11
We can store
these credentials
in Vault…
In order to access
generated credentials,
we store them in Vault.
By storing credentials in accordance with standardized schema. Required systems
and users now have access to provisioned infrastructure.

12. Copyright © 2017 HashiCorp !12
And we can create
policy to provide
access to
credentials…

13. Copyright © 2017 HashiCorp
But, we can do
better…

14. Copyright © 2017 HashiCorp !14
Vault has many
dynamic secrets
backends…
Vault features many different dynamic secrets backends. When building out your
infrastructure, think about how you can best leverage Vault’s built-in features to
secure your environments.

15. Copyright © 2017 HashiCorp !15
We can configure
db access roles
from Terraform…
Since we already have the credentials, we can use these to configure a Dynamic
Secrets backend within Vault.

16. Copyright © 2017 HashiCorp
Demo

17. Thank you.
hello@hashicorp.comwww.hashicorp.com