Encrypt plan files

[suzuki-shunsuke]

Feature Overview

We stored plan files in GitHub Artifacts.

https://suzuki-shunsuke.github.io/tfaction/docs/feature/plan-file

This issue suggests to encrypt plan files somehow.
There would be some options for encryption.

• AWS KMS https://aws.amazon.com/kms/
• Cloud Key Management https://cloud.google.com/security/products/security-key-management
• gpg
• openssl
• etc

Why is the feature needed?

We stored plan files in GitHub Artifacts.

https://suzuki-shunsuke.github.io/tfaction/docs/feature/plan-file

We migrated the storage from S3 or GCS to GitHub Artifacts to prevent plan files from being tampered.
But people with the read permission of the repository can access plan files.
If plan files include secret, this is security issue.
Of course, you should not store secrets in plan files basically, but the security incident can occur.
And attackers can leak secrets to plan files.

Example Code

No response

Note

Even if we encrypt plan files, attackers can decrypt them via CI.