IaC and secrets: Terraform state in the clear

Infrastructure as Code describes infrastructure in versioned files. The recurring problem is secrets: DB passwords, keys, tokens end up in the code or the state.

Where they leak

Terraform's state stores resource attributes, including generated secrets, in cleartext. If the state lands in git or a poorly protected S3 bucket, the secrets are exposed. Other classics: hardcoded values in .tf files, and secrets in the CI/CD plan (logs).

grep -i 'password\|secret\|key' terraform.tfstate
# often full of credentials

Defence

Encrypted remote backend for the state (S3 + KMS, Terraform Cloud) with restricted access, never in git. Secrets from a secret manager referenced at runtime, not hardcoded. Repo scanning (gitleaks, trufflehog) and CI plan scanning. Mark sensitive outputs.