Handle sensitive data and secrets

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Sensitive data and secrets with Vault

Mark values as sensitive

sensitive = true hides a value in plan and apply output. It does not encrypt it in the state.

secrets.tf

variable "db_admin_password" {
  type      = string
  sensitive = true
}
 
output "connection_string" {
  value     = "postgres://admin:${var.db_admin_password}@${azurerm_postgresql_flexible_server.db.fqdn}/shop"
  sensitive = true
}

$terraform plan
  + administrator_password = (sensitive value)
$terraform output -raw connection_string

7.2

Keep secrets out of code

A secret must never be in a .tf or committed .tfvars file.

Good place	How
Environment variable	`export TF_VAR_db_admin_password=…` (CI secret store)
HashiCorp Vault	`vault_kv_secret_v2` data source, or dynamic secrets
Azure Key Vault	`azurerm_key_vault_secret` data source
Generated by Terraform	`random_password` → write it into Key Vault
HCP Terraform	Sensitive workspace variables

keyvault.tf

resource "random_password" "db" {
  length  = 24
  special = true
}
 
resource "azurerm_key_vault_secret" "db" {
  name         = "db-admin-password"
  value        = random_password.db.result
  key_vault_id = azurerm_key_vault.main.id
}

7.3

Read secrets from Vault

Vault stores secrets centrally, with access policies and audit logs. Terraform reads them with the Vault provider; dynamic secrets are created on demand and expire.

vault.tf

provider "vault" {
  address = "https://vault.example.com:8200"
}
 
data "vault_kv_secret_v2" "db" {
  mount = "secret"
  name  = "shop/db"
}
 
resource "azurerm_postgresql_flexible_server" "db" {
  # ...
  administrator_password = data.vault_kv_secret_v2.db.data["password"]
}

At work

Newer Terraform versions add ephemeral values and resources: secrets that are used during the run but never written to plan or state. Use them where your providers support them.

7.4

Protect the state

Because state can hold secrets, treat the state file like a password store.

Use a remote backend with encryption at rest and access control (Azure Storage with RBAC, HCP Terraform).
Turn on versioning / soft delete for the state container.
Give write access to the state only to the pipeline identity.
Never commit *.tfstate to Git: add it to .gitignore.

.gitignore

.terraform/
*.tfstate
*.tfstate.*
*.tfvars
!example.tfvars
crash.log

7.5

Scan the code for security problems

Static scanners find insecure settings (public storage, open NSGs, no encryption) before apply.

$trivy config .
$checkov -d .
$tflint --init && tflint

Tool	Checks
Trivy (config)	Misconfigurations in Terraform, Kubernetes, Dockerfiles
Checkov	Hundreds of cloud security policies
TFLint	Provider-specific errors and best practices

Remember

Put the scan in the pipeline before plan. A failed scan stops the pull request.

All commands in this chapter