Package: tfc-apply-replace
tfc-ws-apply-replaceWhat does it do?This script targets a TFC workspace and runs the equivalent of aterraform apply -replace=[]on a dynamic set of resources determined by a provided keywordWhy?In certain TFC implementations, people will use a tightly controlled organization and workspace to create child organizations and workspaces. This is commonly referred to as theworkspace vending machineapproach.  In this model, the parent workspace is also responsible for managing the child workspace's credentials in the form of sensitive workspace variables.  However, setting those variables once and never rotating them introduces some risk.  Using this script, you can schedule the rotation of those credentials (or any other type of resource).UsageSet an environment variableTFC_TOKENequal to a valid TFC token with adequate permissionsusage: tfc-apply-replace [-h] --org ORG --ws WS --keyword KEYWORD [--message MESSAGE] [-a]

Tool to perform dynamic terraform applies w/replacement on TFC using resource name keywords.

optional arguments:
  -h, --help         show this help message and exit
  --org ORG          Name of the org you're targeting (default: None)
  --ws WS            ID of the workspace you're targeting (default: None)
  --keyword KEYWORD  Keyword matching the beginning of the resource name(s) you are trying to find (default: None)
  --message MESSAGE  Message to be displayed in TFC GUI as the reason for the run (default: API Triggered Key Rotation)
  -a, --auto         Whether or not to auto apply the plan (default: False)ExampleMy parent workspace creates a child workspace and an IAM user specific to the child workspace.  It then generatesaws_iam_access_keycredentials and assigns them to the child workspace as a sensitive variable:resource"aws_iam_user""iam_user"{name="tfc_workspace_${tfe_workspace.workspace.name}"}resource"aws_iam_user_policy_attachment""iam_user_policy_attach"{user=aws_iam_user.iam_user.namepolicy_arn=var.workspace_iam_policy}resource"aws_iam_access_key""workspace_creds"{user=aws_iam_user.iam_user.name}resource"tfe_variable""aws_access_key_id"{key="AWS_ACCESS_KEY_ID"category="env"value=aws_iam_access_key.workspace_creds.idworkspace_id=tfe_workspace.workspace.id}resource"tfe_variable""aws_secret_access_key"{key="AWS_SECRET_ACCESS_KEY"category="env"sensitive=truevalue=aws_iam_access_key.workspace_creds.secretworkspace_id=tfe_workspace.workspace.id}If I wanted to replace/rotate the resourceaws_iam_access_key(and by relation any resource that depends on it, i.e. thetfe_variable.aws_secret_access_keyresource), I would use the resources given nameworkspace_credstfc-apply-replace --org djs-admin --ws ws-Zh2kBGmXrh5hgBxA --keyword workspace_creds
-------------------------------------
TFC Organization Name: some-org
TFC Workspace ID: ws-xxxxxxxxxxxxxxxx
Resource Name FIlter: workspace_creds
Auto Apply: False
-------------------------------------

Found 1 resources whose name(s) start with the keyword:

    module.ws_vending_machine["djs-ec2"].aws_iam_access_key.workspace_creds

Triggering a 'terraform apply -replace=' to rotate the found resources...

Link to run: https://app.terraform.io/app/some-org/workspaces/ws-xxxxxxxxxxxxxxxx/runs/run-xxxxxxxxxxxxxxxx

Status: planning...
Status: cost_estimating...
Status: cost_estimated...

!! Plan is waiting for approval in the GUI, please click the URL provided above !!

Status: confirmed...
Status: applying...
Status: applied...While this workspace manages 23 resources in total, you can see below the script targeted only the resources needed to rotate the downstream workspace's access keys:This script can be scheduled to rotate the credentials limiting the risk of bad terraform code leaking the sensitive variables.