The encryption key used to encrypt a compute disk has been specified in plaintext.
Sensitive values such as raw encryption keys should not be included in your Terraform code, and should be stored securely by a secrets manager.
Impact
The encryption key should be considered compromised as it is not stored securely.
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
Reference a managed key rather than include the key in raw format.
1
2
3
4
5
6
|
resource "google_compute_disk" "good_example" {
disk_encryption_key {
kms_key_self_link = google_kms_crypto_key.my_crypto_key.id
}
}
|
Links