Question

Your platform team runs Terraform from a Cloud Build pipeline in a dedicated CI/CD project. The Terraform configuration needs a database password to provision a Cloud SQL instance, and this password must never appear in the Terraform state that is stored in a GCS remote backend, in build logs, or in the repository. Your security team also requires that the secret be centrally rotated. Which approach best meets all these requirements?

Accepted Answer

Store the password in Secret Manager, grant the Cloud Build service account the Secret Manager Secret Accessor role, and reference the secret at runtime using the availableSecrets field so it is injected as an environment variable during the build.

Answer

Define the password as a Terraform variable with a default value in a variables.tf file committed to the repository, and mark the variable as sensitive = true so it is redacted from logs.

Answer

Pass the password to Terraform via a TF_VAR environment variable defined directly in the cloudbuild.yaml file so it is available to every build step.

Answer

Store the password as a Terraform output value and rely on the GCS backend encryption at rest to protect it from unauthorized access.