Knowledge Base

How do I share Secrets Manager secrets with Kubernetes Pods through Terragrunt/Terraform?

View full discussion in GitHub

Answer

Can I retrieve the secrets in Terragrunt/Terraform and set it up as environment variables on the helm chart inputs/kubernetes manifests/provider resources?

In general, it is recommended to manage secrets by pulling it in the containers, similar to how we do it in our [aws-sample-app](https://github.com/gruntwork-io/aws-sample-app) container. This is to avoid leaking the raw, unencrypted secret into various places (e.g., if you pull the secrets in terragrunt, the raw unencrypted secret ends up in the Terraform state file AND the Deployment Kubernetes manifest such that if you `kubectl describe deployment`, you can read it in plain text).