Secret management integration (Vault, Secrets Manager) in Terraform - Commands & Configuration

Introduction

Storing sensitive information like passwords or API keys directly in code is risky. Secret management tools keep these secrets safe and separate from your code. Terraform can connect to these tools to use secrets securely when creating infrastructure.

When you need to provide database passwords to your infrastructure without exposing them in code.

When your application requires API keys that must stay private and secure.

When you want to rotate secrets regularly without changing your Terraform code.

When multiple teams need access to secrets but with controlled permissions.

When you want to avoid hardcoding sensitive data in Terraform files.

Config File - main.tf

main.tf

terraform {
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "3.11.0"
    }
  }
}

provider "vault" {
  address = "https://vault.example.com"
  token   = "s.1234567890abcdef"
}

resource "vault_generic_secret" "example_secret" {
  path = "secret/data/myapp/config"

  data_json = jsonencode({
    username = "appuser",
    password = "supersecretpassword"
  })
}

output "retrieved_secret" {
  value = vault_generic_secret.example_secret.data.data["password"]
}

This Terraform file connects to a Vault server using the Vault provider.

The vault_generic_secret resource stores a secret at the path secret/data/myapp/config with a username and password.

The output shows how to retrieve the password from Vault after applying the configuration.

Commands

This command initializes Terraform, downloading the Vault provider plugin so Terraform can communicate with Vault.

Terminal

terraform init

Expected Output

Initializing the backend...



Initializing provider plugins...

- Finding hashicorp/vault versions matching ">= 3.0.0"...

- Installing hashicorp/vault v3.11.0...

- Installed hashicorp/vault v3.11.0 (signed by HashiCorp)



Terraform has been successfully initialized!



You may now begin working with Terraform. Try running "terraform plan" to see

any changes that are required for your infrastructure.

This command applies the Terraform configuration, creating or updating the secret in Vault without asking for confirmation.

Terminal

terraform apply -auto-approve

Expected Output

vault_generic_secret.example_secret: Creating...

vault_generic_secret.example_secret: Creation complete after 1s [id=secret/data/myapp/config]



Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

→

-auto-approve - Skip manual approval to apply changes immediately

This command shows the secret value retrieved from Vault after applying the configuration.

Terminal

terraform output retrieved_secret

Expected Output

supersecretpassword

Key Concept

If you remember nothing else from this pattern, remember: always keep secrets out of your code by using a secret manager and access them securely through Terraform.

Common Mistakes

Hardcoding secrets directly in Terraform variables or files.

This exposes sensitive data in code repositories, risking leaks and unauthorized access.

Use secret management tools like Vault and reference secrets dynamically in Terraform.

Not initializing Terraform before applying configuration.

Terraform won't download the necessary provider plugins, causing errors.

Always run 'terraform init' before 'terraform apply' to prepare the environment.

Using expired or invalid Vault tokens in the provider configuration.

Terraform cannot authenticate to Vault, so secret operations fail.

Ensure the Vault token is valid and has permissions to read/write secrets.

Summary

Initialize Terraform to download the Vault provider plugin.

Apply the Terraform configuration to store or update secrets in Vault.

Retrieve secrets securely from Vault using Terraform outputs.

Practice

1. What is the main purpose of integrating Terraform with a secret management tool like Vault or AWS Secrets Manager?

easy

A. To securely store and access sensitive data like passwords and API keys outside the code

B. To speed up Terraform plan and apply operations

C. To automatically generate Terraform configuration files

D. To monitor cloud resource usage and billing

Solution

1. Step 1: Understand secret management purpose

   Secret management tools keep sensitive data safe and separate from code to reduce risk.

2. Step 2: Connect to Terraform integration goal

   Terraform uses these tools to fetch secrets securely during infrastructure deployment without hardcoding them.

3. Final Answer:

   To securely store and access sensitive data like passwords and API keys outside the code -> Option A

4. Quick Check:

   Secret management = Secure external storage [OK]

Hint: Secrets keep sensitive data out of code [OK]

Common Mistakes:

• Thinking secret managers speed up Terraform
• Confusing secret management with billing tools
• Assuming secret managers generate configs

2. Which Terraform block correctly configures AWS Secrets Manager to read a secret named db_password?

easy

A. variable "db_password" { default = "aws_secretsmanager_secret.db_password" }

B. resource "aws_secretsmanager_secret" "example" { name = "db_password" }

C. provider "aws" { secret_name = "db_password" }

D. data "aws_secretsmanager_secret_version" "example" { secret_id = "db_password" }

Solution

1. Step 1: Identify correct Terraform data source for reading secret

   Terraform uses data "aws_secretsmanager_secret_version" to read secret values from AWS Secrets Manager.

2. Step 2: Check syntax correctness

   The block uses secret_id = "db_password" to specify the secret name, which is correct for reading.

3. Final Answer:

   data "aws_secretsmanager_secret_version" "example" { secret_id = "db_password" } -> Option D

4. Quick Check:

   Read secret = data source block [OK]

Hint: Use data block to read secrets, not resource [OK]

Common Mistakes:

• Using resource block to read secrets
• Putting secret name in provider block
• Assigning secret as variable default incorrectly

3. Given this Terraform snippet using Vault provider:

data "vault_generic_secret" "db" {
  path = "secret/data/database"
}

output "db_password" {
  value = data.vault_generic_secret.db.data["password"]
}

What will be the output if the secret at secret/data/database contains {"password": "pass123"}?

medium

A. "data.vault_generic_secret.db.data[\"password\"]"

B. "pass123"

C. Error: secret not found

D. null

Solution

1. Step 1: Understand Vault data source usage

   The vault_generic_secret data source reads secrets at the given path and stores them in data map.

2. Step 2: Access the password key in output

   The output accesses data.vault_generic_secret.db.data["password"], which matches the secret's password value "pass123".

3. Final Answer:

   "pass123" -> Option B

4. Quick Check:

   Output secret value = "pass123" [OK]

Hint: Access secret data map keys directly [OK]

Common Mistakes:

• Expecting error if secret exists
• Outputting the literal string instead of value
• Confusing data structure keys

4. You wrote this Terraform code to read a secret from AWS Secrets Manager:

data "aws_secretsmanager_secret_version" "db" {
  secret_id = aws_secretsmanager_secret.db.name
}

resource "aws_secretsmanager_secret" "db" {
  name = "my_db_password"
}

Terraform plan fails with error: Reference to undeclared resource. What is the problem?

medium

A. The resource block is missing required parameters

B. The secret_id should be a string, not a resource attribute

C. The data source references the resource before it is declared

D. Terraform cannot read secrets from AWS Secrets Manager

Solution

1. Step 1: Analyze resource and data source order

   The data source references aws_secretsmanager_secret.db.name before the resource is declared, causing a dependency error.

2. Step 2: Understand Terraform resource referencing rules

   Terraform requires resources to be declared before referencing them in data sources to resolve dependencies correctly.

3. Final Answer:

   The data source references the resource before it is declared -> Option C

4. Quick Check:

   Reference order matters in Terraform [OK]

Hint: Declare resources before referencing them [OK]

Common Mistakes:

• Using resource attributes as string literals
• Ignoring declaration order
• Assuming Terraform can't read AWS secrets

5. You want to securely pass a database password stored in Vault to an AWS RDS instance using Terraform. Which approach follows best practices?

hard

A. Use vault_generic_secret data source to fetch password, then pass it as password argument in aws_db_instance resource without storing it in Terraform state

B. Hardcode the password in Terraform variables and update Vault manually

C. Store the password in a local file and read it in Terraform

D. Create the RDS instance first, then manually update password in Vault

Solution

1. Step 1: Identify secure secret retrieval method

   Using vault_generic_secret data source fetches the password securely at runtime without hardcoding.

2. Step 2: Pass secret directly to resource without storing in state

   Passing the secret as an argument avoids exposing it in Terraform files or state, following best practices.

3. Final Answer:

   Use vault_generic_secret data source to fetch password, then pass it as password argument in aws_db_instance resource without storing it in Terraform state -> Option A

4. Quick Check:

   Fetch secrets dynamically and avoid hardcoding [OK]

Hint: Fetch secrets dynamically, never hardcode passwords [OK]

Common Mistakes:

• Hardcoding secrets in variables
• Storing secrets in local files
• Manual secret updates outside Terraform