Secrets written into Terraform files

This rule flags lines that assign a double-quoted literal of six or more characters to a secret-named attribute. The names are password, secret_key, access_key, private_key, client_secret and api_key, with or without a prefix such as db_password, plus secret and token on their own. Values containing $ and commented-out lines are skipped. A secret whose value is a plain name, such as "jobs-data", is a reference and passes.

A secret in Terraform is in every clone and in the history. It is usually in the state file too, so removing it from the code does not remove every copy.

Take secrets out of Terraform and rotate them. Read the value from a secret manager or a variable marked sensitive, then rotate it. Deleting the line does not remove it from history.

Before:

resource "snowflake_user" "loader" {
  name     = "LOADER"
  password = "placeholder-value"
}

After:

variable "loader_password" {
  type      = string
  sensitive = true
}

resource "snowflake_user" "loader" {
  name     = "LOADER"
  password = var.loader_password
}

A dummy value for a local emulator or a throwaway test stack guards nothing. Make it obviously fake. Tell us, and the finding comes out of your report. Anything that has reached a live account needs rotating.

The .tf files you supply. We report the file and line, never the value, and we refuse .tfvars and state files by name. An attribute set from a variable is not flagged.