<p>Cloud-init has the ability to compliment Terraform in configuring the Virtual Machine it just created. My problem is that cloud-init as uploaded through <code>user-data</code> means that the script especially if multi-part is available on the OpenStack metadata server.</p>
<p>This means <em>any</em> user on that virtual machine can get that user-data by simply running</p>
<pre><code>curl http://169.254.169.254/latest/user-data
</code></pre>
<p>Is there anyway to pass secrets in a cloud-init file?</p>
<hr />
<p>This is a follow up to <a href="https://devops.stackexchange.com/q/15628/18965"><em>&quot;Is there a way to install a private key for a user with cloud-init?&quot;</em></a>. There I ask a question which could conceivably be answered with a provisioner that doesn't use cloud-init at all. This question is more broad.</p>

<terraform><cloud-init>
Is there a way to pass secrets in cloud-init using Terraform?
Evan Carroll
# Is there a way to pass secrets in cloud-init using Terraform?

(Asked by: username_0 on 2023-02-07)

Cloud-init has the ability to compliment Terraform in configuring the Virtual Machine it just created. My problem is that cloud-init as uploaded through user-data means that the script especially if multi-part is available on the OpenStack metadata server.
This means any user on that virtual machine can get that user-data by simply running
curl http://169.254.169.254/latest/user-data

Is there anyway to pass secrets in a cloud-init file?

This is a follow up to "Is there a way to install a private key for a user with cloud-init?". There I ask a question which could conceivably be answered with a provisioner that doesn't use cloud-init at all. This question is more broad.

**Tags:** terraform, cloud-init


---

## 0 answers

