๐
Main concepts
๐ฐ
Platforms
Resource Sanitization
Terraform state can contain very sensitive data. Sometimes this is unavoidable because of the design of certain Terraform providers, or because the definition of what is sensitive isn't always simple and may vary between individuals and organizations. To avoid leaking sensitive data, Spacelift takes the approach of automatically sanitizing any resources stored or passed to plan policies by default.
For example, if we take the following definition for an EC2 instance:
1
resource "aws_instance" "this" {
2
ami = "ami-abc123"
3
instance_type = "t3.small"
4
โ
5
root_block_device {
6
volume_size = 50
7
}
8
โ
9
tags = {
10
Name = "My Instance"
11
}
12
}
Copied!
Spacelift will supply something similar to the following to any plan policies:
1
{
2
...,
3
"terraform": {
4
"resource_changes": [
5
{
6
"address": "module.instance.aws_instance.this",
7
"change": {
8
"actions": ["create"],
9
"after": {
10
"ami": "c4cb6118",
11
...,
12
"tags": {
13
"Name": "d3dac282"
14
},
15
"tags_all": {
16
"Name": "d3dac282"
17
},
18
}
19
}
20
}
21
]
22
}
23
}
24
โ
Copied!
As you can see, the
ami and tags fields have had their values sanitized, and replaced with hashes. The same sanitization is also applied to resources shown in the resources views.Sanitization and Plan Policies
Sometimes you need to perform a comparison against a sanitized value in a plan policy. To help with this we provide a
sanitized() helper function that you can use in your policies.Disabling Sanitization
If you have a situation where the
sanitized() helper function doesn't provide you with enough flexibility to create a particular policy, you can disable sanitization completely for a stack. To do this, add the feature:disable_resource_sanitization label to your stack. This will disable sanitization for any future runs.Last modified 7mo ago
Copy link