Terraformのsensitive変数とシークレット管理｜SSMパラメータストア参照で秘密情報を安全に扱う設計

この記事のポイント

・sensitive = true はログ隠蔽のみ。tfstateには平文でシークレットが残る
・SSM Parameter Store（SecureString）でシークレットをコード外で管理する
・outputにsensitive指定を忘れるとCI/CDログに平文が流れる
・リモートバックエンドのSSE-KMS暗号化が最低限の対策

variable "db_password" {
  type        = string
  sensitive   = true
  description = "RDSインスタンスのマスターパスワード"
}

resource "aws_db_instance" "main" {
  identifier = "myapp-prod"
  username   = "admin"
  password   = var.db_password
  # ...
}

# terraform plan の出力例（sensitive = true を設定した場合）
Terraform will perform the following actions:

  # aws_db_instance.main will be created
  + resource "aws_db_instance" "main" {
      + identifier = "myapp-prod"
      + password   = (sensitive value)
      + username   = "admin"
    }

Plan: 1 to add, 0 to change, 0 to destroy.

# terraform.tfstate の抜粋（JSON形式 / パスワード部分を伏字）
{
  "resources": [
    {
      "type": "aws_db_instance",
      "name": "main",
      "instances": [
        {
          "attributes": {
            "password": "P@ssw0rd!****",
            "username": "admin",
            "endpoint": "myapp-prod.xxxxxxxxxx.ap-northeast-1.rds.amazonaws.com"
          }
        }
      ]
    }
  ]
}

# backend.tf
terraform {
  backend "s3" {
    bucket         = "myapp-terraform-state"
    key            = "prod/terraform.tfstate"
    region         = "ap-northeast-1"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:ap-northeast-1:123456789012:key/mrk-xxxx"
    dynamodb_table = "terraform-state-lock"
  }
}

# AWS CLIでSecureStringを登録する（事前作業）
aws ssm put-parameter   --name "/myapp/prod/db_password"   --value "P@ssw0rd!2024"   --type SecureString   --key-id "alias/myapp-kms-key"   --region ap-northeast-1

# 登録確認（--with-decryptionを付けないと暗号化されたまま返る）
aws ssm get-parameter   --name "/myapp/prod/db_password"   --with-decryption   --region ap-northeast-1

# data.tf
data "aws_ssm_parameter" "db_password" {
  name            = "/myapp/prod/db_password"
  with_decryption = true
}

# rds.tf
resource "aws_db_instance" "main" {
  identifier        = "myapp-prod"
  engine            = "mysql"
  engine_version    = "8.0"
  instance_class    = "db.t3.medium"
  allocated_storage = 20
  db_name           = "myapp"
  username          = "admin"
  password          = data.aws_ssm_parameter.db_password.value

  skip_final_snapshot       = false
  final_snapshot_identifier = "myapp-prod-final"
}

# terraform plan の出力（SSMから取得した値はsensitiveとして自動隠蔽される）
Terraform will perform the following actions:

  # aws_db_instance.main will be created
  + resource "aws_db_instance" "main" {
      + identifier        = "myapp-prod"
      + password          = (sensitive value)
      + username          = "admin"
      + endpoint          = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

# output.tf（NG例 - sensitive指定なし）
output "db_password" {
  value = data.aws_ssm_parameter.db_password.value
}

# terraform plan 実行時のエラー
Error: Output refers to sensitive values

  on output.tf line 2:
   2:   value = data.aws_ssm_parameter.db_password.value

To reduce the risk of accidentally exporting sensitive data that
was not intended to be exported, Terraform requires that any
root module output containing sensitive data be explicitly
marked as sensitive, to confirm your intent.

# output.tf（OK例 - sensitive指定あり）
output "db_password" {
  value     = data.aws_ssm_parameter.db_password.value
  sensitive = true
}

# sensitive = true でもターミナルでは実値が取得できる
$ terraform output db_password
"P@ssw0rd!****"

# -json フラグでも同様
$ terraform output -json
{
  "db_password": {
    "sensitive": true,
    "type": "string",
    "value": "P@ssw0rd!****"
  }
}