feat: add awesome secrets in code

[rileydakota]

Adding secrets in code my service can access stuff!!!!

[github-actions]

Terraform plan in src
With backend config files: src/tf.backend

Plan: 1 to add, 0 to change, 1 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # aws_instance.bastion must be replaced
-/+ resource "aws_instance" "bastion" {
      ~ arn                                  = "arn:aws:ec2:us-east-2:391294193874:instance/i-0096ca17992a38403" -> (known after apply)
      ~ availability_zone                    = "us-east-2b" -> (known after apply)
      ~ cpu_core_count                       = 1 -> (known after apply)
      ~ cpu_threads_per_core                 = 2 -> (known after apply)
      ~ disable_api_termination              = false -> (known after apply)
      ~ ebs_optimized                        = false -> (known after apply)
      - hibernation                          = false -> null
      + host_id                              = (known after apply)
      ~ id                                   = "*******************" -> (known after apply)
      ~ instance_initiated_shutdown_behavior = "stop" -> (known after apply)
      ~ instance_state                       = "running" -> (known after apply)
      ~ ipv6_address_count                   = 0 -> (known after apply)
      ~ ipv6_addresses                       = [] -> (known after apply)
      + key_name                             = (known after apply)
      + outpost_arn                          = (known after apply)
      + password_data                        = (known after apply)
      + placement_group                      = (known after apply)
      ~ primary_network_interface_id         = "*********************" -> (known after apply)
      ~ private_dns                          = "ip-10-0-1-80.us-east-2.compute.internal" -> (known after apply)
      ~ private_ip                           = "10.0.1.80" -> (known after apply)
      + public_dns                           = (known after apply)
      ~ public_ip                            = "18.224.109.30" -> (known after apply)
      ~ secondary_private_ips                = [] -> (known after apply)
      ~ security_groups                      = [] -> (known after apply)
        tags                                 = {
            "owner"   = "Dakota"
            "project" = "nku-iac-security"
        }
      ~ tenancy                              = "default" -> (known after apply)
      + user_data                            = "fdcff0c97ad4024c490676100443b9dad91ade44" # forces replacement
      + user_data_base64                     = (known after apply)
        # (10 unchanged attributes hidden)

      ~ capacity_reservation_specification {
          ~ capacity_reservation_preference = "open" -> (known after apply)

          + capacity_reservation_target {
              + capacity_reservation_id = (known after apply)
            }
        }

      - credit_specification {
          - cpu_credits = "unlimited" -> null
        }

      + ebs_block_device {
          + delete_on_termination = (known after apply)
          + device_name           = (known after apply)
          + encrypted             = (known after apply)
          + iops                  = (known after apply)
          + kms_key_id            = (known after apply)
          + snapshot_id           = (known after apply)
          + tags                  = (known after apply)
          + throughput            = (known after apply)
          + volume_id             = (known after apply)
          + volume_size           = (known after apply)
          + volume_type           = (known after apply)
        }

      ~ enclave_options {
          ~ enabled = false -> (known after apply)
        }

      + ephemeral_block_device {
          + device_name  = (known after apply)
          + no_device    = (known after apply)
          + virtual_name = (known after apply)
        }


      + network_interface {
          + delete_on_termination = (known after apply)
          + device_index          = (known after apply)
          + network_interface_id  = (known after apply)
        }

      ~ root_block_device {
          ~ delete_on_termination = true -> (known after apply)
          ~ device_name           = "/dev/xvda" -> (known after apply)
          ~ encrypted             = false -> (known after apply)
          ~ iops                  = 0 -> (known after apply)
          + kms_key_id            = (known after apply)
          ~ tags                  = {} -> (known after apply)
          ~ throughput            = 0 -> (known after apply)
          ~ volume_id             = "*********************" -> (known after apply)
          ~ volume_size           = 8 -> (known after apply)
          ~ volume_type           = "standard" -> (known after apply)
        }
        # (1 unchanged block hidden)
    }

Plan: 1 to add, 0 to change, 1 to destroy.

Plan generated in Terraform PR Plan #72

[rileydakota]

Canary for AWS AK/SK from https://canarytokens.org/generate
Wired to a webhook at https://webhook.site/#!/c34c3cdd-5e44-4254-b233-7727f7c8ce14/9c7b2b41-7cf5-44f2-b68f-672dbc93e4ef/1 whenever it is accessed