Security

Secure Terraform configurations, state files, credentials, and the entire workflow against common security threats.

What Will You Learn? #

Security is a critical aspect of Terraform that is often overlooked. From secret exposure to credential management, one security mistake can have a huge impact. This section comprehensively covers all aspects of Terraform security.

Articles in This Section #

Article	Main Topic
Provider Authentication	Securing connections to cloud providers
Environment & Secret	Managing environment variables and secrets safely
Least Privilege	Applying the least privilege principle to Terraform IAM
Secret Exposure Risk	The risk of secrets exposed in state, logs, and code
Common Security Mistakes	Frequent security mistakes and how to avoid them
Credential Rotation Strategy	Regular credential rotation strategies

Security Layers #

flowchart TD
    subgraph Code["Code Level"]
        VARS["Variables<br/>mark sensitive"]
        GITIGNORE[".gitignore<br/>tfvars, state"]
    end

    subgraph Runtime["Runtime Level"]
        ENV["Environment Variables<br/>TF_VAR_, AWS_*"]
        VAULT["HashiCorp Vault<br/>Dynamic secrets"]
    end

    subgraph State["State Level"]
        ENCRYPT["Encrypt State<br/>backend encryption"]
        ACCESS["Access Control<br/>IAM policies"]
    end

    subgraph Pipeline["Pipeline Level"]
        MASK["Secret Masking<br/>CI/CD masking"]
        SCAN["Security Scanning<br/>tfsec, checkov"]
    end

    Code --> Runtime --> State --> Pipeline

    style Code fill:#e3f2fd
    style Runtime fill:#e8f5e9
    style State fill:#fff3e0
    style Pipeline fill:#f3e5f5

Secret Exposure Risk #

flowchart TD
    RISK["Secret Exposure"] --> WHERE["Where can secrets be exposed?"]
    WHERE --> STATE["State File<br/>plaintext passwords"]
    WHERE --> LOGS["Terraform Logs<br/>plan output"]
    WHERE --> VCS["Version Control<br/>tfvars committed"]
    WHERE --> CLI["CLI History<br/>terraform apply -var"]

    STATE --> FIX1["Encrypt backend<br/>Limit access"]
    LOGS --> FIX2["Sensitive mark<br/>Log redaction"]
    VCS --> FIX3[".gitignore<br/>git-secrets hook"]
    CLI --> FIX4["Use .tfvars<br/>or Vault"]

    style RISK fill:#ffcdd2
    style FIX1 fill:#c8e6c9
    style FIX2 fill:#c8e6c9
    style FIX3 fill:#c8e6c9
    style FIX4 fill:#c8e6c9

Credential Rotation #

flowchart LR
    A["Generate<br/>New Key"] --> B["Update<br/>Terraform"]
    B --> C["Test<br/>Apply"]
    C --> D["Rotate<br/>CI/CD"]
    D --> E["Revoke<br/>Old Key"]
    E -->|"Next cycle"| A

    style A fill:#e3f2fd
    style E fill:#ffebee

Security is a shared responsibility. Continue to Best Practice to see the best guides from production experience.