A common mistake new administrators make when getting started with Infrastructure-as-Code is committing secrets (passwords, access keys, and so on) in their repositories. While this makes their infrastructure repeatable, it also makes it much more likely their credentials will be compromised. Once something is in version control, it's hard and annoying to remove it (that's the point of version control!). Even if you do remove it, it's almost impossible to know if it has already been viewed/copied by someone unintended.
In this recipe, we will introduce and use the open source tool, Unicreds.
Note
Unicreds is a Golang port of the Python tool, Credstash: https://github.com/fugue/credstash. While the functionality is very similar, Unicreds has the benefit of being cross-platform and dependency-free!
Since this pattern is completely backed by AWS services, it removes the need to manage (and worry about) password vaults, shared passwords, and committing sensitive information to SCM...