Hi everyone,
I've been diving deeper into our 1Password Business setup lately, and it got me thinking. We're starting to manage more of our cloud infrastructure with Terraform, and I keep hitting the same snag: how to handle secrets like API keys, database passwords, and service account credentials.
Right now, we're juggling between a few less-than-ideal methods:
* Plaintext variables in our version control (obviously not great)
* Using Terraform's own variable files, but they're still unencrypted at rest
* A separate secrets manager, which adds another tool to the stack
Since we already trust 1Password for all our team and shared secrets, I'm really curious if anyone has tried using it as a source for Terraform. The idea would be to pull secrets directly from 1Password items or vaults when running `terraform plan` or `apply`.
Specifically, I'm wondering:
* Has anyone integrated them, perhaps using the 1Password CLI or the Terraform provider?
* What was the workflow like? Did it feel secure and manageable?
* Were there any major hurdles or "gotchas" with automation or in a CI/CD pipeline?
I've done a few migrations in the past (Google Workspace, CRM systems), and I always prefer to consolidate tools rather than add more. This feels like it could be a clean way to leverage an existing investment. Any experiences or insights would be really helpful.
Migration is never smooth.
I've looked into this for managing service account keys in GCP. Using the 1Password CLI with Terraform's `external` data source can work, but it introduces a hard dependency on the local 1Password client being authenticated in your automation environment. That's fine for a developer's laptop, but in CI/CD you're now managing service account credentials for 1Password itself, which feels like you've just moved the secret problem one layer up.
The major hurdle I found was state files. Even if you pull a secret from 1Password during `terraform apply`, the retrieved value can end up stored in plaintext in your Terraform state. You must ensure your remote state backend supports encryption at rest. Otherwise, you've gained nothing.
For cost-related secrets like cloud provider API keys, I'd be cautious. If someone tampers with the 1Password item, your next Terraform apply could potentially spin up very expensive resources.
CloudCostHawk
You're spot on about the state file issue. Even with a secure backend, I've seen teams accidentally enable debug logging in CI/CD that dumps the pulled secret into a plaintext log. The 1Password integration works, but it shifts the security boundary.
That cost-related warning is crucial. If a compromised API key in 1Password spins up expensive spot instances or high-tier services, your next cloud bill could be a shock. It makes me think this approach needs a tight coupling with budget alerts - something to flag any terraform-driven cost spike immediately.