noisypigeon.garden

cloudflare/api-token v0.3.0

By noisypigeon.garden

This files LIB-0054 and builds its library half. The rollout of LIB-0053 posted a new API key's access key ID in a public apply comment: the comments mask secret values, but print every identifier Terraform prints.

Redaction (github/workflows)

  • render-run-comments.js redacts identifiers after masking secrets, and replaces each with (redacted). It uses three rules:

    • by attribute: id, anything ending _id or _ids, access_key, srn, arn, and bucket;
    • by progress line: the [id=…] on Creating… and Refreshing state… lines;
    • by shape, anywhere: UUIDs, Scaleway access key IDs, and Cloudflare- and Backblaze-shaped IDs. Word boundaries keep a commit SHA intact.

    A bucket's name and endpoints are redacted too.

  • It fails closed. A leaf whose detail still holds an ID-shaped string is withheld, its summary row says so, and the run warns.

  • scrub-run-comments.sh deletes old bot run comments that carry Terraform output. It deletes rather than edits, because edits keep a public history, and prints counts only.

  • scaleway-job-run.yml masks the definition's and run's IDs, and stops printing them.

  • scripts-test fails if terragrunt-run.yml ever prints output.txt.

Rotation by generation (modules and github/terragrunt)

  • The key modules take rotation_generation. That's scaleway/iam-api-key, cloudflare/api-token and backblaze/api-key. A number above 0 replaces the key at once, create-before-destroy, and re-creates its timestamps, so the new key gets a fresh expiry. At 0 nothing changes, so every existing key plans No changes.

  • root.hcl passes it from .config/spoke.hcl:

    • rotation_generation applies to the whole spoke;
    • rotation_generations maps a unit's directory to a number of its own, for a canary.

    Neither is set yet.

  • The LIB-0053 deployer gap is fixed here:

    • a workload with scaleway.job grants its deployer ServerlessJobsFullAccess;
    • a job secret adds SecretManagerFullAccess.

    LIB-0053 gets an amendment recording it.

Docs

  • The record, LIB-0054-redact-identifiers-and-rotate-secrets.md.
  • The runbook, rotate-all-secrets.md.

Release: release:minor, which releases github/workflows, github/terragrunt, and the three key modules. Nothing in runway changes until a later PR bumps the pins.

Tested locally:

  • node --test tools/github/scripts/*.test.js passes 64 tests, plus the 2 check-policies failures that only fail locally and predate this PR;
  • terraform fmt and terragrunt hcl fmt are clean;
  • rendering the real apply fixture redacts each bucket's ID, name and endpoints, and the [id=…]s, and withholds nothing.

Generated by Claude Code

PR: https://github.com/noisypigeon/runway/pull/195