Why security matters in IaC in Terraform - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why is it important to keep secrets out of Terraform code?

In Infrastructure as Code (IaC), why should sensitive information like passwords or API keys not be hardcoded directly in Terraform files?

A Because hardcoded secrets automatically encrypt themselves, so it is unnecessary.

B Because Terraform does not support variables for sensitive data.

C Because secrets in code make Terraform run slower.

D Because hardcoding secrets can expose them in version control and logs, risking unauthorized access.

💡 Hint

Think about who can see the code and what happens if secrets are exposed.

Hardcoding secrets in Terraform files risks exposing them in places like version control systems or logs. This can lead to unauthorized access to cloud resources. Instead, secrets should be stored securely and injected at runtime.

❓ Architecture

intermediate

What is a secure way to manage secrets in Terraform?

Which method is the most secure way to handle sensitive values like passwords in Terraform configurations?

A Store secrets in environment variables or secret management services and reference them in Terraform variables marked as sensitive.

B Write secrets directly in Terraform files as plain text variables.

C Use Terraform locals to store secrets inside the configuration.

D Commit secrets in encrypted files inside the same repository without access controls.

💡 Hint

Consider how secrets can be kept out of code and safely injected during deployment.

Using environment variables or dedicated secret management services keeps secrets out of code and version control. Marking variables as sensitive in Terraform prevents them from being shown in logs.

❓ service_behavior

advanced

What happens if Terraform state files contain unencrypted secrets?

Terraform stores state files to track infrastructure. What is the risk if these state files contain unencrypted sensitive data?

A Anyone with access to the state file can read sensitive information, leading to potential security breaches.

B Terraform will automatically encrypt the state file, so there is no risk.

C The state file size will increase but no security risk occurs.

D Terraform will refuse to apply changes if secrets are in the state file.

💡 Hint

Think about who can access the state file and what information it contains.

State files often contain sensitive data in plain text. If not encrypted or access-controlled, anyone who can read the state file can steal secrets or modify infrastructure.

❓ security

advanced

Which Terraform backend setup improves security for state files?

Which backend configuration best protects Terraform state files containing sensitive data?

A Commit state files to a public Git repository for easy sharing.

B Store state files locally on developer machines without encryption.

C Use a remote backend with encryption at rest, access controls, and versioning enabled.

D Use a remote backend without any access restrictions or encryption.

💡 Hint

Consider how to protect state files from unauthorized access and accidental loss.

Remote backends with encryption, strict access controls, and versioning protect state files from unauthorized access and accidental deletion, improving security.

✅ Best Practice

expert

What is the best practice to prevent accidental exposure of secrets in Terraform workflows?

Which practice most effectively prevents accidental exposure of secrets during Terraform development and deployment?

A Rely on developers to manually check for secrets before committing code.

B Implement automated scanning of Terraform code and state files for secrets before commits and deployments.

C Store all secrets in plain text files alongside Terraform code for easy access.

D Disable Terraform logging to hide secret values during runs.

💡 Hint

Think about how automation can help catch mistakes early.

Automated scanning tools detect secrets in code and state files before they are committed or deployed, reducing human error and accidental exposure.