AI
Artifact Visibility and Day-Two Operations
Managing golden images beyond day one means knowing what is inside them. Packer now captures an SBOM inline during the build: an hcp_packer_sbom block uploads the bill of materials as part of the artifact, and the Packer UI surfaces the full package list and versions. The next step is automatic CVE correlation, so a team running an affected OpenSSL version gets a direct signal to rotate that image.
Without that indexed inventory, most enterprises cannot quickly answer which running instances are exposed when a CVE drops.
Terraform Stacks GA and Bulk Import
Terraform Stacks is now generally available. Stacks give Terraform a first-class model of multiple environments (dev, stage, prod) and component layers (network, middleware, application), managed as one unit. The GA release ships a revamped UI, Azure DevOps and Bitbucket backend support, and better self-managed agent support for private environments.
The second announcement is Terraform Search, now in public beta. Teams that click-ops’d 80% of their estate can point Search at an AWS account, use a declarative list block to find unmanaged VM instances, and watch the Terraform Search bulk import demo (11:30) autogenerate import blocks ready for terraform apply.
Terraform Actions and Ansible Integration
Terraform has always modeled CRUD well but had no native answer for imperative day-two tasks: restarting a crashed app, taking a pre-modification database backup, or running an Ansible playbook weeks after provisioning. Workarounds like null resources
“felt a bit icky, right?” — Armon Dadgar
Terraform Actions adds a first-class HCL block, tied to resource lifecycle hooks (before/after create, modify, destroy) or callable ad hoc. The Terraform Actions and Ansible live demo (19:52) shows a code commit triggering a Terraform apply that fires an event into Ansible Automation Platform, which then installs software and configures a firewall on the new EC2 instances.
Secret Sprawl and Credential-Free Access
Vault Radar now catches hardcoded credentials before they leave the developer’s machine. The updated IDE plugin flags a secret the moment a file is saved and offers a one-click path to store it in Vault without leaving the editor. The same release adds Jira scanning: when a developer pastes credentials into a support ticket, Radar flags it.
“need to protect the secret everywhere.” — Armon Dadgar
Boundary adds RDP to its credential-injection protocols. A user selects a Windows target, Boundary fetches a short-lived credential from Vault, and injects it into the session. The user never sees the password, closing the ticket-and-script exposure path.
Vault 1.21 and Dynamic Identity
Vault 1.21, releasing in October, adds two SPIFFE-native workflows. SPIFFE-based authentication lets a workload authenticate against Vault using its SPIFFE identity and get back a token. SVID minting reverses it: a Vault token yields a SPIFFE identity for system-to-system calls. Dadgar called this pattern important for AI agent workloads that need cryptographic identity proof.
VSO protected secrets deliver credentials to Kubernetes pods via a CSI driver, bypassing unencrypted storage in the Kubernetes secrets object. HCP Vault Dedicated adds Azure DNS peering and AWS PrivateLink. A Vault Secrets Inventory dashboard shows when each secret was last accessed and flags stale entries.
Notable Quotes
felt a bit icky, right? Armon Dadgar · ▶ 13:41
the sky’s is the limit. Hicham Mourad · ▶ 23:39
need to protect the secret everywhere. Armon Dadgar · ▶ 30:52
Key Takeaways
- Terraform Stacks is now generally available, managing multi-environment and multi-component estates as one unit.
- Terraform Actions adds lifecycle and ad-hoc imperative operations natively in HCL, closing the day-two gap.
- Vault Radar now scans IDEs and Jira in real time, while Boundary injects RDP credentials so users never see them.