Secret management integration (Vault, Secrets Manager) in Terraform - Step-by-Step Execution

Process Flow - Secret management integration (Vault, Secrets Manager)

Define secret in Vault/Secrets Manager

↓

Configure Terraform provider for Vault/Secrets Manager

↓

Reference secret in Terraform configuration

↓

Terraform plan reads secret securely

↓

Terraform apply uses secret to configure resources

↓

Secret remains secure, not exposed in state or logs

This flow shows how Terraform integrates with secret managers to securely use secrets during infrastructure deployment.

Execution Sample

Terraform

provider "vault" {
  address = "https://vault.example.com"
}

data "vault_generic_secret" "db_password" {
  path = "secret/data/db"
}

resource "aws_db_instance" "example" {
  password = data.vault_generic_secret.db_password.data["password"]
}

Terraform reads a database password from Vault and uses it to create an AWS database instance.

Process Table

Step	Action	Terraform State	Secret Accessed	Result
1	Initialize Vault provider	Provider configured	No	Ready to read secrets
2	Read secret at path 'secret/data/db'	Secret data fetched	Yes	Password retrieved securely
3	Plan AWS DB instance with secret password	Plan created	Yes	Password referenced in plan
4	Apply AWS DB instance creation	Resource created	Yes	DB instance created with secret password
5	Post-apply state	State saved without secret value	No	Secret not exposed in state file

💡 Terraform completes apply; secret used securely without exposure.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
vault_secret_password	null	"superSecret123"	"superSecret123"	"superSecret123"	null (not stored)
terraform_state	empty	provider configured	plan created	resource created	state saved without secret

Key Moments - 2 Insights

Why doesn't the secret value appear in the Terraform state file after apply?

Terraform reads the secret at runtime but does not store the actual secret value in the state file to keep it secure, as shown in execution_table step 5.

How does Terraform access the secret without exposing it in logs?

Terraform uses the Vault provider's secure API to fetch secrets at runtime and references them internally without printing them, as seen in execution_table steps 2 and 3.

Visual Quiz - 3 Questions

Look at the execution table, at which step does Terraform fetch the secret from Vault?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Check the 'Secret Accessed' column in execution_table row for step 2.

According to the variable tracker, what is the value of 'vault_secret_password' after step 4?

A null

B empty string

C "superSecret123"

D not defined

💡 Hint

Look at the 'vault_secret_password' row in variable_tracker after step 4.

If Terraform stored the secret in the state file, which step in the execution table would change?

A Step 5

B Step 3

C Step 2

D Step 1

💡 Hint

Refer to the 'Result' column in execution_table step 5 about state file contents.

Concept Snapshot

Terraform secret management integration:
- Configure Vault or Secrets Manager provider
- Use data sources to read secrets securely
- Reference secrets in resource configs
- Secrets fetched at runtime, not stored in state
- Keeps secrets safe during infrastructure deployment

Full Transcript

This visual execution shows how Terraform integrates with secret management systems like Vault or Secrets Manager. First, Terraform configures the provider to connect securely. Then it reads the secret data at runtime without exposing it in logs or state files. The secret is used to configure resources, such as a database password. After apply, the secret remains secure and is not stored in the Terraform state file. This ensures secrets are handled safely during infrastructure deployment.