Secrets & SSM conventions
Naming convention
Two prefixes, built from Terraform locals:
/{environment}/{client_code}/...— environment-scoped (local.ssm_key_prefix)./shared/{client_code}/...— shared across environments (local.global_ssm_key_prefix).
client_code is drive throughout.
What's stored where
| Path pattern | Contains | Who provisions it |
|---|---|---|
/{env}/drive/snowflake/organization_name, account_name, account_identifier, admin_user, admin_role | Placeholder values | Terraform creates the parameter; a human fills in the real value afterward |
/{env}/drive/snowflake/drive_{env}_admin/private_key, public_key | Terraform's own Snowflake provider auth keypair | Terraform creates the placeholder only |
/{env}/drive/snowflake/service-users/{service}/private_key, public_key | RSA keys for each of the 8 service users (dbt, sigma, tableau, airbyte, n8n, iio, readonly, agentic_mcp) | Terraform creates the placeholder; the real key is generated and uploaded manually |
/{env}/drive/snowflake/default_human_password | Shared initial password for the ENGINEER/PRODUCT human users | Terraform creates and reads it back |
/shared/drive/snowflake/pagerduty/integration_key | PagerDuty Events API v2 routing key | Terraform creates the placeholder; filled manually, never committed |
/{env}/drive/s3/stock.drive.com.au/id, /arn (stock.drivemustang.com.au on staging); /{env}/drive/s3/manifold-{env}.drive.com.au/id, /arn | Source bucket identity | Not provisioned here — read-only lookup against a parameter owned by another repo |
/{env}/drive/s3/<bucket>/... for the bronze/export buckets | Bucket id/arn | Terraform provisions the bucket, publishes these parameters, then reads them back within the same state |
/{env}/drive-apig/marketplace/apikeys/internal, /{env}/drive-apig/udp/apikeys/internal | Third-party/internal API Gateway keys | Not provisioned here — read-only lookup, owned elsewhere |
The pattern
Terraform provisions the SSM parameter object with a placeholder value and an ignore_changes = [value] lifecycle block — it never manages the real secret material. Keys and passwords are generated and uploaded out-of-band by whoever is doing the setup.
Terraform also reads several parameters it doesn't create at all: the source S3 bucket identities, and internal API Gateway keys. Those are a genuine "someone else owns this" boundary — don't expect to find where they're set inside this repo.
See also
- Prerequisites & setup — where the dbt service-account keys from this table get pulled down locally.
- Snowflake resources & RBAC