title: Why shouldn't a Salt top file use grains for matching sensitive pillars?
body: <p><a href="http://docs.saltstack.com/en/latest/topics/best_practices.html" rel="nofollow">The Salt documentation says:</a></p>
  
  <blockquote>
    <p>Don't use grains for matching in your pillar top file for any sensitive pillars.</p>
  </blockquote>
  
  <p>But it doesn't elaborate any further, leaving a few open questions:</p>
  
  <ol>
  <li><p>First: Why not? I assume this is because the grains are provided by the minion, so a compromised minion could lie about any of its grains to gain any pillar data that it shouldn't have, but I'm just asking to be explicit about it.</p></li>
  <li><p>Most importantly: What <em>should</em> a pillar top file use for matching? And why don't other matchers suffer the same security problem as grains? For example, doesn't the minion also provide its own ID?</p></li>
  </ol>