How to Handle Secrets in Terraform Securely and Effectively

In Terraform, handle secrets by avoiding hardcoding them in .tf files and instead use secure methods like environment variables, encrypted remote state, or secret management tools such as HashiCorp Vault. This keeps sensitive data safe and prevents accidental exposure in code repositories.

Why This Happens

Many beginners put secrets like passwords or API keys directly in Terraform files. This is risky because these files often get saved in code repositories or shared, exposing sensitive data. Terraform state files also store these secrets in plain text by default, which can leak secrets if not protected.

terraform

resource "aws_db_instance" "example" {
  allocated_storage    = 20
  engine               = "mysql"
  instance_class       = "db.t2.micro"
  name                 = "mydb"
  username             = "admin"
  password             = "SuperSecret123"  # Hardcoded secret
  parameter_group_name = "default.mysql5.7"
}

Output

Warning: Sensitive data exposed in configuration

Error: Sensitive values should not be hardcoded in Terraform files.

The Fix

Use environment variables or secret management tools to inject secrets at runtime instead of hardcoding them. Also, enable encryption for Terraform state files and use remote backends like AWS S3 with encryption or HashiCorp Vault to store secrets securely.

terraform

variable "db_password" {
  description = "The password for the database"
  type        = string
  sensitive   = true
}

resource "aws_db_instance" "example" {
  allocated_storage    = 20
  engine               = "mysql"
  instance_class       = "db.t2.micro"
  name                 = "mydb"
  username             = "admin"
  password             = var.db_password
  parameter_group_name = "default.mysql5.7"
}

# Set the password via environment variable before running Terraform
# export TF_VAR_db_password="SuperSecret123"

Output

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Note: The password is not shown in the output because it is marked sensitive.

Prevention

Always mark sensitive variables with sensitive = true to hide them in logs and outputs. Use remote backends with encryption enabled for Terraform state files to protect secrets stored there. Integrate secret managers like HashiCorp Vault or AWS Secrets Manager to fetch secrets dynamically. Avoid committing secrets to version control by using .gitignore and environment variables.

Related Errors

Common related errors include Terraform showing secrets in plan or apply outputs, or state files being exposed publicly. Fix these by marking variables as sensitive and using encrypted remote state backends. Another error is missing secrets at runtime, which happens if environment variables are not set properly.

Key Takeaways

Never hardcode secrets directly in Terraform configuration files.

Use sensitive variables and environment variables to pass secrets securely.

Encrypt Terraform state files and use remote backends to protect stored secrets.

Integrate secret management tools like Vault for dynamic secret retrieval.

Exclude secrets from version control using .gitignore and environment variables.