We manage all this with Terraform, which is a tool for writing infrastructure setup as code. We’ve talked previously about how we already use this for our 1Password.com service, I’ll let you check out that post if you’d like to learn more. For this project, Terraform made it simple to create an identical internal testing site for. HashiCorp Terraform CloudFormation is an excellent option for many AWS customers, and we successfully used it to deploy 1Password environments for over two years. At the same time we wanted to move to Terraform as our main infrastructure tool for several reasons. A 1Password Secrets Manager terraform module. Used to fetch secrets from 1Password.

Well-funded cybersecurity provider 1Password today introduced a new service that enterprises can use to protect infrastructure secrets such as encryption keys.

The company also revealed that it has acquired Netherlands-based SecretHub to help it develop more features for the new service, which it’s launching under the name Secrets Automation.

Terraform 1password App

Toronto-based 1Password, incorporated as AgileBits Inc., is backed by $200 million from investors such as Accel. It provides a cloud platform that about 80,000 businesses use worldwide to manage the usernames and passwords with which employees log into work applications.

Secrets Automation, the new service 1Password introduced today, is also designed for managing sensitive data. However, it focuses not on employees login credentials but rather “secrets,” small files that organizations’ backend applications use to secure the data they work with.

For example, when a financial forecasting application needs to access data from a company’s accounting system, it must send a unique password known as an API token before it can view the requested records. The company’s corporate website, meanwhile, broadcasts a piece of data called a security certificate to tell visitors’ browsers that launching a network connection is safe. Such secrets serve the same function as usernames and passwords, only for machine-to-machine interactions.

With the newly launched Secrets Automation service, 1Password is promising to simplify secret management. The service provides a centralized interface that allows administrators to maintain their companies’ website security certificates, API tokens and other cybersecurity-related files such as encryption keys in one place. They can control which application can access what secret and limit how secrets may be used by each workload.

The service offers integrations with several popular backend technologies including Kubernetes, HashiCorp Vault, Terraform and Ansible that will allow companies to manage secrets used by those platforms. There’s also a connector for GitHub thanks to a partnership that 1Password announced today with the Microsoft Corp. subsidiary. The connector will allow developers to manage the secrets of the applications that they develop with GitHub’s code hosting platform, the companies said.

The main benefit 1Password promises to deliver through its new service is centralization. A large company can have upwards of hundreds of secrets that are often scattered among different teams and systems. The lack of centralized controls makes it difficult for administrators to prevent secrets from falling into hackers. Bringing everything together in one place, 1Password argues, allows administrators to manage secrets more consistently and thereby securely.

When secrets are hosted on a single platform, it’s also possible to track how they’re used more effectively. Secrets Automation is shipping with auditing features that 1Passoword says will allow companies to create a record of how users and systems interact with secrets, which is useful for breach detection purposes.

Terraform 1password Extension

“We are the first company to bring both human and machine secrets together in a significant and easy-to-use way,” said 1Password Chief Executive Jeff Shiner.

In conjunction with the product launch, the company today also disclosed that it has bought Netherlands-based firm SecretHub and hired members of its team to advance the engineering roadmap for Secrets Automation. SecretHub has developed a product similar to Secrets Automation that companies use to provide increased security for their applications’ sensitive data. The terms of the deal were not disclosed.

Image: 1Password

Since you’re here …

Show your support for our mission with our one-click subscription to our YouTube channel (below). The more subscribers we have, the more YouTube will suggest relevant enterprise and emerging technology content to you. Thanks!

Support our mission: >>>>>> SUBSCRIBE NOW >>>>>> to our YouTube channel.

… We’d also like to tell you about our mission and how you can help us fulfill it. SiliconANGLE Media Inc.’s business model is based on the intrinsic value of the content, not advertising. Unlike many online publications, we don’t have a paywall or run banner advertising, because we want to keep our journalism open, without influence or the need to chase traffic.The journalism, reporting and commentary on SiliconANGLE — along with live, unscripted video from our Silicon Valley studio and globe-trotting video teams at theCUBE — take a lot of hard work, time and money. Keeping the quality high requires the support of sponsors who are aligned with our vision of ad-free journalism content.

If you like the reporting, video interviews and other ad-free content here, please take a moment to check out a sample of the video content supported by our sponsors, tweet your support, and keep coming back to SiliconANGLE.

Terraform 1password Tutorial

Lately I have been writing a lot of Terraform code for some personal projects. After copying certain files around for the 5th or 6th time, I decided to make a skeleton repository for Terraform projects to make things a little easier.

When I first started with Terraform a few years ago, I wanted to have my repositories structured in a logical fashion, but nothing I found seemed to fit what I was looking for. I searched the internet to find out what HashiCorp recommended and what other people are doing, but nothin I saw really felt right to me. In examining what other people were doing, however, I was able to take the best parts from various layouts and meld it into a structure that worked for me and I have been using it ever since.

I expect that many will look at my layout and feel the same way I did about many of the ones I looked at. Hopefully, you will be able to take a way at least a nugget or two to help you with your structure. You can check out the GitHub repo here.

Directory Layout

The directory layout is pretty straight forward. It contains a directory for all the project variables and Terraform files as well as a Makefile and Jenkinsfile for automation. The file tree of the directory looks like this:

Projects

The projects directory stores the .tfvars file for each project. The skeleton repo contains two directories. The globals directory is run each time Terraform is run. It contains variables that are constant across deployments. The template directory is an example of an individual project file. When you use Makefile or Jenkinsfile to run the Terraform command, it will run with the global variables as well as the variables of the defined project. I think of a project as an individual instantiation of the Terraform state. It could be an environment (development/staging/production), accounts (aws1, aws2, etc), or even regions (us-west-1, eu-east-1, etc).

Makefile

I do not remember where I came across the idea to use a Makefile for running my Terraform commands, but it has been extremely useful. It allows me to run multiple commands at once without typing long command lines. Prior to running the make file, you need to set two environmental variables. The BUCKET variable is used in the terraform init</code> command to set the S3 bucket used to store state. The PROJECT</code> variable is the project that you want to run the terraform for. This variable is used in the name of the Terraform state file as well as to choose which project variables to run.

Jenkinsfile

The Jenkinsfile is used to run the terraform commands from Jenkins. It runs a a Jenkins pipeline that includes 4 stages: Checkout, Initialize the Backend, Terraform Plan, and Terraform Apply/Destroy. As requires 5 parameters to run the job: The name of the S3 bucket, the project name, the Git credentials to use, the AWS credentials to use, and a dropdown to apply or destroy the project.

Terraform Files

Rather than cramming everything into a single file, I tend to use more files rather than less for readability. To that end I generally have 5 .tf files that I use when working with Terraform.

Terraform Password

backend.tf

The backend.tf file contains information about which backend to use (S3 in my case).

provider.tf

The provider.tf file contains which provider to use. My directory defaults to the AWS provider, but I have used Azure and GCP as well.

main.tf

This is where I define which modules I want to use. Now that Terraform has a module registry, I try to use that as much as possible, but occasionally I will write my own.

Terraform 1password Plugin

variables.tf

The variables.tf file is used to initialize all the variables that I want to pass in via my projects file.

outputs.tf

The outputs.tf file is for storing any outputs that you may want to make available to other Terraform projects at a later time.

Errata

Terraform 1password Provider

The README.md and LICENSE file are self explanitory.

Starting a New Project

Now when I start a new project, it is relatively easy for me to . Since I use GitHub, all my commands will be tailored for that platform.

Create an Empty Repository on GitHub

Start by creating an empty repository on GitHub. You can do this through the web interface, or if you have a GitHub token you can create it through the API with the following command:

This will return the SSH URL for the newly created repo.

Clone the Skeleton Repo

Next you can clone the skeleton repository to your local machine and rename it to your new repo:

Change the Origin

Once you have the skeleton repository checked out, you can update the origin and push the code back up to GitHub:

That’s it. I am now ready to start developing my new Terraform project.

UPDATE: I’ve moved my skeleton repo to be a GitHub Template. You can find more information here