Externalize sensitive configuration values in backup templates #574

Summary

Hardcoding sensitive information such as AWS Account IDs, Backup Vault ARNs, and KMS Key ARNs in the goldstack.json configuration file is a security risk as these values are committed to version control.

Affected Packages

• @workspaces/templates/packages/backup/
• @workspaces/templates/packages/backup-central/

Details

In the current implementation of these templates, several sensitive AWS-related values are defined directly in the goldstack.json file.

workspaces/templates/packages/backup/goldstack.json

• centralBackupVaultArn
• destinationAccountId
• destinationKmsKeyArn

workspaces/templates/packages/backup-central/goldstack.json

• allowedAccountIds
• sourceAccountIds
• sourceRoleArns

Proposed Solution

These sensitive values should be externalized and loaded from environment variables or a secure secrets management system (e.g., using .env files), as recommended in the project's documentation. This should be applied to all deployments within these packages to ensure that sensitive data is not checked into the repository.