使用 Git 存储库作为 Terraform 中的 AWS Lambda 源的最佳方法？

Question

I'm working with Terraform to configure an AWS Lambda with API Gateway and DynamoDB, for the infrastructure i'm using a private repository and for the Lambda code source i'm using a different private repository.

After a research i have already found a way to download a source code to use in Terraform using:

locals {
  package_url = "https://github.com/.../main.zip"
  downloaded  = "downloaded_package_${md5(local.package_url)}.zip"
  lambda_src_path = "${path.module}/lambda"

 }

resource "null_resource" "download_package" {
     triggers = {
          downloaded = local.downloaded
     }

     provisioner "local-exec" {
         command = "curl -L -o ${local.downloaded} ${local.package_url}"
     }
 }

This would work fine if the repo is public, otherwise a solution would be using:

curl -H 'Authorization: token TOKEN' \
-H 'Accept: application/vnd.github.v3.raw' \
-O \
-L https://api.github.com/repos/owner/repo/contents/path

I would like to ask what would be the best solution to achieve that, maybe using.env data inside the Terraform repository.

Thanks

Answer 1

Don't store secrets in.env file, since those would be part of repo and at risk to be compromised. You should never store secrets in repo. The solution depends on where you actually have your repo hosted. But all providers support storing secrets one way or another.

For example github has https://docs.github.com/en/actions/security-guides/encrypted-secrets