---
title: "Secrets written into Terraform files | Metacenta"
description: "How we find passwords, tokens and keys written as literals in Terraform without reading them, and why the state file means rotation is the only fix."
url: "https://metacenta.com/rules/tf-secret-literal"
updated: "2026-10-14"
tokens: 620
---

Repository hygiene · rule tf-secret-literal

# Secrets written into Terraform files

A Metacenta review checks this under the rule **No secret is written into Terraform**. Everything below applies whether or not you ever commission one.

## What this rule checks

This rule flags lines that assign a double-quoted literal of six or more characters to a secret-named attribute. The names are `password`, `secret_key`, `access_key`, `private_key`, `client_secret` and `api_key`, with or without a prefix such as `db_password`, plus `secret` and `token` on their own. Values containing `$` and commented-out lines are skipped. A `secret` whose value is a plain name, such as `"jobs-data"`, is a reference and passes.

## Why it matters

A secret in Terraform is in every clone and in the history. It's usually in the state file too, so removing it from the code doesn't remove every copy.

## How to fix it

**Take secrets out of Terraform and rotate them.** Read the value from a secret manager or a variable marked `sensitive`, then rotate it. Deleting the line does not remove it from history.

Before:

```hcl
resource "snowflake_user" "loader" {
  name     = "LOADER"
  password = "placeholder-value"
}
```

After:

```hcl
variable "loader_password" {
  type      = string
  sensitive = true
}

resource "snowflake_user" "loader" {
  name     = "LOADER"
  password = var.loader_password
}
```

## When it is fine to leave

A dummy value for a local emulator or a throwaway test stack guards nothing. Make it obviously fake. Tell us, and the finding comes out of your report. Anything that has reached a live account needs rotating.

## What we need to check it

The `.tf` files you supply. We report the file and line, never the value, and we refuse `.tfvars` and state files by name. An attribute set from a variable is not flagged.

[Ask about a review](https://metacenta.com/enquire?src=rule-tf-secret-literal&via=md)

## Related pages

- [Credential files committed to a data repository](https://metacenta.com/rules/repo-committed-credential-file)
- [Data repository with no CI pipeline](https://metacenta.com/rules/repo-no-ci)
- [Archived repositories under review](https://metacenta.com/rules/repo-archived)
- [Data repository with no tests](https://metacenta.com/rules/repo-no-tests)
- [A sample review, as a client reads it](https://metacenta.com/sample)
- [All published rules](https://metacenta.com/rules)
- [How a review is assessed](https://metacenta.com/standard)