Hello, Does anyone have recommendations on how to manage dynamic environment variables for user/pass type of variables? Say I have a staging space, but within it, I have an app hosted on aws and one on azure. Example: When the comment is

atlantis plan -p azure

, a script or something grabs the azure credentials and sets them. When its

atlantis plan -p aws

, something should remove the azure ones and place the aws ones. Project type: monolith that 2 atlantis servers (staging and prod) talk too. Technically there will be 4 backends. Sadly can't use .tfvars or anything that would let them be stored in the state file (not allowed).

this is more of a TF problem than Atlantis…

Yeah I know 😞 . I was looking into pre_workflow hooks, would I be able to grab the git comment and see the user has put

aws

or

azure

?

you can run a script so you can do whatever you want

Yeah, I was thinking of utilizing custom workflows too. Looks like my thought process is heading in the right direction. Sucks I have to do this manually, but oh well. Thank you 🙏

where are you are running atlantis? aws?

Secrets management that stores the creds on the instance running Atlantis and you pull through with ENV vars.

The Atlantis terraform hosted on Openshift manages an app that is hosted on aws and azure.

If you are already using vault for openshift, I would use Vault. I would either pull secrets using the terraform vault provider to set them on the Atlantis instance, or see if there’s a way to passthrough secrets through open shift ENV to the Atlantis Terraform

Can’t use the vault provider since it stores the secrets in the state file. I am currently passing the secrets through open shift env to Atlantis, but just need it conditional since the provider only has one “username” and “pass” parameter.

It’s a good start there, they trigger every run

Exactly! Once I start coding it I will know. 🤞