CLI security

  • HTTPS only. The SDK rejects http:// URLs (tls_required).
  • Pin the agent CA. --ca-file or --ca-pem. No TOFU.
  • Do not put credentials in the URL.
  • Prefer EVE_IAC_TOKEN after eve-iac login --json over repeating passwords.
  • Mask secrets in CI. --json login prints token.
  • --yes is the only confirmation. There are no interactive prompts. Do not pass --yes on validate/plan.
  • Do not commit passwords, tokens, .eve-iac-state.json if it is treated as runtime, or private keys.
  • The CLI does not call 127.0.0.1 EVE REST. Only the agent does, on the EVE host.

Shared concepts: security.