Security
Security
How amicu handles secrets, endpoint authentication, state, and network access.
These pages describe what amicu does with credentials and where data goes. They describe the CLI in this repository.
| Page | Question it answers |
|---|---|
| Secrets | How do credentials get into a deployment without appearing in config, plans, state, or command lines? |
| Endpoint auth | How does amicu make sure a deployed endpoint is not open? |
| State | What is recorded, what is never recorded, and what happens when apply fails partway? |
| Telemetry and network | What does the CLI send, and to whom? |
Summary
- Secrets are references (
secret("NAME")). Values are read from your environment at apply time. - Values never appear in HCL, plan output, state, logs, or command-line arguments. They reach the runtime through its environment, in a file readable only by you.
- Every deployment that is reachable off the machine must have an API key.
- After every deploy that has an
api_key, or that is reachable off the machine, amicu checks that an anonymous request is refused. If it is not, amicu stops the endpoint and fails the apply. Loopback endpoints without anapi_keyskip the check. - The CLI sends no telemetry.