question re terraform and github actions / secrets

Question

I am starting to learn terraform/github actions. Is it possible to get TF to read Github secrets as part of the Github action ? For example ..

My main.tf file creates an AWS EC2 instance, and, needs to install nginx using a provisioner. in order to do that i need to provide my private/public key information to the provisoner for it to authentiate to the EC2 instance to install the app. I have created a github secret that contains my private key.

At the moment the workflow keeps failing becuase i cannot get it to read the github secret that contains the private key info.

How can i achieve this ?

any advise would be most welcome ! thanks

Answer 1

The simplest way is to use an environment variable.

Terraform reads the value for its variables from environment. The next piece is to translate the GitHub secret in an environment variable.

In practice, if your Terraform script has a variable declaration like

variable "my_public_key" {}

and you have a GitHub secret NGINX_PUBKEY, then you can use this syntax in your workflow

steps:
  - run: terraform apply -auto-approve
    env:
      TF_VAR_my_public_key: ${{ secrets.NGINX_PUBKEY }}

This said I would not recommend using GitHub secrets for this kind of data: they are better managed in a secret-management store like AWS Secrets Manager, Azure KeyVault, Hashicorp Vault, etc.