Reel · Terraform & Infra · Nov 2, 2026
Your Terraform state file holds secrets in plain text
In short
Terraform state stores the real values of your resources, and that includes things like database passwords and API keys. If the state file sits on someone's laptop, so do your secrets. The reel's three fixes: move state off laptops to a remote backend (S3, Terraform Cloud), turn on encryption and locking with access only for the pipeline, and pull secrets from a vault or secret manager instead of keeping them in state. The plot twist: sensitive = true only hides a value on screen. In the state file the value is still there.
Checklist: what to do about it
- Find out where every workspace's state lives today. Any state on a laptop is the first fix.
- Move state to a remote backend (for example S3 or Terraform Cloud).
- Turn on encryption at rest and state locking for that backend.
- Limit read access to the state to your CI/CD pipeline and a small break-glass group.
- Fetch secrets at runtime from a vault or secret manager instead of passing them through Terraform where you can.
- Remember that
sensitive = truehides output on screen only. Treat the state file itself as a secret. - Make sure state files are git-ignored so nobody commits one by accident.
- Rotate any secret you find that has already lived in a laptop or repo copy of state.