Show HN: Digger – Open Source Terraform automation and collaboration tool
1–10 of 24 posts
Re: Show HN: Digger – Open Source Terraform automation and collaboration tool
#2They migrated from Python to Golang
More Detailed Here: https://old.reddit.com/r/golang/comments/14rduec/we_rewrote_...
Re: Show HN: Digger – Open Source Terraform automation and collaboration tool
#3One of the major security issues with running terraform in your CI/CD pipeline is that it usually needs admin permissions to your entire cloud environment. To avoid this you need the pipeline to pass parameters to an internal process that actually applies the changes.
Digger makes it sound like it might address this:
> Digger runs terraform natively in your CI. This is: Secure, because cloud access secrets aren't shared with a third-party
From the Github+AWS demo:
> 4. Add environment variables into your Github Action Secrets (cloud keys are a requirement since digger needs to connect to your account for coordinating locks) AWS_ACCESS_KEY_ID & AWS_SECRET_ACCESS_KEY
It sure looks like AWS admin credentials are shared with Github, and also available to anything else in the diggerhq/digger action.
Re: Show HN: Digger – Open Source Terraform automation and collaboration tool
#4One of the major security issues with running terraform in your CI/CD pipeline is that it usually needs admin permissions to your entire cloud environment. To avoid this you need the pipeline to pass parameters to an internal process that actually applies the changes. Digger makes it sound like it might address this: > Digger runs terraform natively in your CI. This is: Secure, because cloud access secrets aren't sha…
Yeah, weird for them to do that. Managing credentials like that sucks even from an ergonomics standpoint.
In practice, it's pretty normal to use OIDC to authenticate Github Actions to AWS:
https://docs.github.com/en/actions/deployment/security-harde...
Re: Show HN: Digger – Open Source Terraform automation and collaboration tool
#5One of the major security issues with running terraform in your CI/CD pipeline is that it usually needs admin permissions to your entire cloud environment. To avoid this you need the pipeline to pass parameters to an internal process that actually applies the changes. Digger makes it sound like it might address this: > Digger runs terraform natively in your CI. This is: Secure, because cloud access secrets aren't sha…
Yeah, weird for them to do that. Managing credentials like that sucks even from an ergonomics standpoint. In practice, it's pretty normal to use OIDC to authenticate Github Actions to AWS: https://docs.github.com/en/actions/deployment/security-harde...
Ok yeah, looks like they recently added OIDC support: https://docs.digger.dev/cloud-providers/authenticating-with-...
They should update the main readme to include this under Features, and also call it out in the demo files.
Re: Show HN: Digger – Open Source Terraform automation and collaboration tool
#6One of the major security issues with running terraform in your CI/CD pipeline is that it usually needs admin permissions to your entire cloud environment. To avoid this you need the pipeline to pass parameters to an internal process that actually applies the changes. Digger makes it sound like it might address this: > Digger runs terraform natively in your CI. This is: Secure, because cloud access secrets aren't sha…
> It sure looks like AWS admin credentials are shared with Github, and also available to anything else in the diggerhq/digger action
I am a co-founder of Terrateam[0] which is a Terraform CI/CD as well. At the end of the day, you need to execute something to do these operations and having this component open source is important for auditing purposes. For Terrateam, we lean heavily into GitHub Actions so GitHub is at least managing any secrets and runs. One challenge is users could pin the Action that we publish to a specific version, but we also update it regularly and communicating to customers to update it is a challenge.
Re: Show HN: Digger – Open Source Terraform automation and collaboration tool
#7One of the main reasons for us to use a terraform collaboration tool is to easily manage state files.
Would be awesome if they find a way to integrate state management.
Re: Show HN: Digger – Open Source Terraform automation and collaboration tool
#8One of the major security issues with running terraform in your CI/CD pipeline is that it usually needs admin permissions to your entire cloud environment. To avoid this you need the pipeline to pass parameters to an internal process that actually applies the changes. Digger makes it sound like it might address this: > Digger runs terraform natively in your CI. This is: Secure, because cloud access secrets aren't sha…
One of the founders here
You could also use OIDC so no need to share keys
https://docs.digger.dev/cloud-providers/authenticating-with-...
Re: Show HN: Digger – Open Source Terraform automation and collaboration tool
#9They migrated from Python to Golang More Detailed Here: https://old.reddit.com/r/golang/comments/14rduec/we_rewrote_...
Indeed we did :)
Also blogged about it: https://medium.com/@DiggerHQ/we-rewrote-our-product-in-go-fr...
Re: Show HN: Digger – Open Source Terraform automation and collaboration tool
#10One of the main reasons for us to use a terraform collaboration tool is to easily manage state files. Would be awesome if they find a way to integrate state management.
Thanks!! Great point; for now we're relying on S3+dynamo which many people prefer anyways; but state management is on the roadmap, we'll get to it soon
Tracking here: https://github.com/diggerhq/digger/issues/206
And btw contributions very welcome, we're a small team so every bit helps, even if it's just filing or labeling an issue