Because grains can be set by users that have access to the minion configuration files on the local system, grains are considered less secure than other IDENTIFIERS in Salt. Use caution when targeting sensitive operations or SETTING pillar values based on grain DATA.

When POSSIBLE, you should target sensitive operations and data USING the Minion ID. If the Minion ID of a system changes, the Salt Minion's public key must be re-accepted by an administrator on the Salt Master, making it less vulnerable to impersonation attacks.

Because grains can be set by users that have access to the minion configuration files on the local system, grains are considered less secure than other identifiers in Salt. Use caution when targeting sensitive operations or setting pillar values based on grain data.

When possible, you should target sensitive operations and data using the Minion ID. If the Minion ID of a system changes, the Salt Minion's public key must be re-accepted by an administrator on the Salt Master, making it less vulnerable to impersonation attacks.