TF enables to specify --secret option on CLI. It may be handy to pass some credentials without having them visible in a log. It would be nice to support it somehow in newa. While we could use --environment to specify credentials those would be visible in all YAML files etc.
Idea: Assume the secret is available to newa process and environment variable. newa recipe could specify
secrets:
- envvar1
- envvar2
which would mean that secret envvar1 has value stored in an environment variable envvar1. newa could read the value and then pass it to TF CLI as --secret envvar1=value where the value would be masked in TC command in YAML file.
TF enables to specify
--secretoption on CLI. It may be handy to pass some credentials without having them visible in a log. It would be nice to support it somehow in newa. While we could use--environmentto specify credentials those would be visible in all YAML files etc.Idea: Assume the secret is available to newa process and environment variable. newa recipe could specify
which would mean that secret
envvar1has value stored in an environment variableenvvar1. newa could read the value and then pass it to TF CLI as--secret envvar1=valuewhere the value would be masked in TC command in YAML file.