Skip to content

Commit

Permalink
Update README
Browse files Browse the repository at this point in the history
  • Loading branch information
breml committed Jun 4, 2024
1 parent b3e07cd commit 7109118
Showing 1 changed file with 41 additions and 6 deletions.
47 changes: 41 additions & 6 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,24 +1,41 @@
# tfreveal

[![Test Status](https://github.com/breml/tfreveal/workflows/Main/badge.svg)](https://github.com/breml/tfreveal/actions?query=workflow%3AMain)
[![Go Report Card](https://goreportcard.com/badge/github.com/breml/tfreveal)](https://goreportcard.com/report/github.com/breml/tfreveal) [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)

tfreveal is an open-source tool designed to enhance the visibility of Terraform
plan files by displaying all differences in resources and outputs, including
sensitive values. Unlike Terraform, which hides sensitive data, tfreveal reveals
these values to ensure complete transparency in your infrastructure changes.

## Motivation

Terraform does mask sensitive values in the output (e.g. from `terraform plan`)
in order to protect them from being revealed to 3rd parties.
in order to protect them from being revealed to unauthorized 3rd parties.

Sometimes it is neccessary to see the exact changes, Terraform will perform to the
infrastructure including all the changes to sensitive values. So far, Terraform
does not provide a feature to forcefully unmask the sensitive values in the
But sometimes it is neccessary to see the exact changes, Terraform will perform
to the infrastructure including all the changes to sensitive values. In
particular, if one observes drift between the Terraform state and the actual
state of the infrastructure, this becomes inevitable. So far, Terraform does not
provide a feature to forcefully unmask the sensitive values in the
[concise diff plan outputs](https://www.hashicorp.com/blog/terraform-0-14-adds-a-new-concise-diff-format-to-terraform-plans).

The general advice given by the Terraform maintainers is to use the JSON output
in such cases. While the JSON output does provide all the necessary information,
it is not perticularely easy to read for humans and to spot small differences.
It gets even more complicated, if the sensitive values contain larger JSON
encoded values.
It gets even more complicated, if the changes are contained in larger JSON
encoded values, that are marked as sensitive.

There exists instructions using for example `jq`, but the process stays manual,
cumbersome and error prone.

`tfreveal` is here to fix this and provide an easy way to show the concise diff
plan outputs with all sensitive values revealed.

## Installation

Download the latest release from the [releases page](https://github.com/breml/tfreveal/releases).

## Usage

The plan file generated from Terraform can be directly piped to `tfreveal`:
Expand All @@ -36,6 +53,24 @@ $ terraform show -json plan.out > plan.json
$ tfreveal plan.json
```

## Development

The task to update the test data and the golden files is provided in the
`Taskfile.yml` and can be executed by running `task gen-all`. This requires the
`task` tool to be installed. Please refer to the
[official documentation](https://taskfile.dev/installation/).

Additionally the `terraform` command needs to be present in the `PATH`. Follow
the [official installation instructions](https://developer.hashicorp.com/terraform/install).

## Author

Copyright 2024 by Lucas Bremgartner ([breml](https://github.com/breml))

## License

[MIT License](LICENSE)

## Trademarks

All other trademarks referenced herein are the property of their respective owners.

0 comments on commit 7109118

Please sign in to comment.