From ccbdf6c02e895c4e6249bd57c262a95280bb0d53 Mon Sep 17 00:00:00 2001
From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Date: Tue, 12 Aug 2025 22:16:02 -0500
Subject: [PATCH] Best practice Terraform (#31827)
Add info about how Fleet handles AWS Secrets Manager. More context:
https://github.com/fleetdm/fleet/pull/31134
---
articles/deploy-fleet-on-aws-with-terraform.md | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/articles/deploy-fleet-on-aws-with-terraform.md b/articles/deploy-fleet-on-aws-with-terraform.md
index c3f48a6193..c4aa5d37da 100644
--- a/articles/deploy-fleet-on-aws-with-terraform.md
+++ b/articles/deploy-fleet-on-aws-with-terraform.md
@@ -5,7 +5,7 @@ The simplest way to get started with Fleet at scale is to use AWS with Terraform
This workflow takes about 30 minutes to complete and supports between 10 and 350,000 hosts.
-### Prerequisites
+## Prerequisites
- A new or existing Amazon Web Services (AWS) account
@@ -17,7 +17,7 @@ This workflow takes about 30 minutes to complete and supports between 10 and 350
- A fully qualified domain name (FQDN) for hosting Fleet
-### Instructions
+## Instructions
1. [Download](https://github.com/fleetdm/fleet-terraform/blob/main/example/main.tf) the Fleet `main.tf` Terraform file.
@@ -81,6 +81,10 @@ terraform apply
12. That’s it! You should now be able to log in to Fleet and [enroll a host](https://fleetdm.com/docs/using-fleet/enroll-hosts).
+## Advanced
+
+Fleet's best practice Terraform, already supports putting the [`server_private_key`](https://fleetdm.com/docs/configuration/fleet-server-configuration#server-private-key) and other secrets in AWS secrets manager. Check out how in the [best practice Terraform](https://github.com/fleetdm/fleet-terraform/blob/def4b3320640cd70de83ccdae4e77a388ad1ff96/byo-vpc/byo-db/byo-ecs/main.tf#L100).
+