Security and Secrets Management

The day we found AWS credentials in Git taught me that infrastructure security isn't optional

Introduction: The Security Incident

It was a Tuesday morning when our security team sent the Slack message that made my stomach drop:

Security Alert: AWS credentials found in public GitHub repository

I clicked the link. There, in our Terraform repository's commit history, were AWS access keys in plain text. A developer had committed them six months ago while debugging. The repository had been public for three of those months.

The credentials had administrative access.

We spent the next 72 hours:

Rotating every credential
Auditing all AWS activity
Implementing secrets management
Re-educating the entire team
Dealing with a security audit

The damage:

$4,000 in unauthorized EC2 instances (crypto mining)
120 hours of team time
A very uncomfortable conversation with leadership
Mandatory security training for everyone

That incident transformed how we handle secrets in Terraform.

I learned:

Never commit secrets to version control
State files contain secrets and must be secured
Secrets management is not optional
Encryption at rest is table stakes
Access controls prevent most breaches

This article is everything I learned about securing Terraform infrastructure, from basic secrets management to enterprise-grade security.

Why Infrastructure Security Matters

Attack Surface

Infrastructure as code exposes:

Cloud provider credentials
Database passwords
API keys
Encryption keys
SSH keys
Service account tokens

One compromised credential can:

Destroy infrastructure
Steal data
Mine cryptocurrency
Deploy malware
Exfiltrate secrets

Common Attack Vectors

The Cost of Insecurity

Direct costs:

Unauthorized resource usage
Data breach penalties
Incident response
Security audits

Indirect costs:

Lost productivity
Reputation damage
Customer trust
Regulatory scrutiny

Security Principles for Terraform

1. Least Privilege

Grant minimum permissions necessary.

Bad:

# Admin access for everything
provider "aws" {
  access_key = var.admin_key
  secret_key = var.admin_secret
}

Good:

# Specific permissions for Terraform
# IAM role with limited permissions
provider "aws" {
  assume_role {
    role_arn = "arn:aws:iam::123456789:role/TerraformRole"
  }
}

2. Defense in Depth

Multiple layers of security.

3. Zero Trust

Never trust, always verify.

Principles:

Verify every access
Encrypt everything
Assume breach
Continuous validation

4. Immutable Infrastructure

Prevent runtime changes.

Benefits:

No configuration drift
Predictable deployments
Easy rollbacks
Audit trail

Securing Terraform State

State files contain secrets in plain text.

What's in State?

# Extract secrets from state
terraform show -json | jq '.values.root_module.resources[] | select(.sensitive_values != null)'

Common secrets in state:

Database passwords
API keys
Private keys
Access tokens
Connection strings

State Security Checklist

✅ Use remote backend ✅ Enable encryption at rest ✅ Enable encryption in transit ✅ Use state locking ✅ Implement access controls ✅ Enable versioning ✅ Configure backups ✅ Audit access

Secure Remote Backend (S3)

terraform {
  backend "s3" {
    bucket         = "terraform-state-prod"
    key            = "infrastructure/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true  # Encryption at rest
    kms_key_id     = "arn:aws:kms:us-east-1:123456789:key/12345678"
    dynamodb_table = "terraform-locks"  # State locking
    
    # Access logging
    acl = "private"
  }
}

S3 bucket policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::terraform-state-prod/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

Secure Remote Backend (Terraform Cloud)

terraform {
  cloud {
    organization = "my-org"
    
    workspaces {
      name = "production"
    }
  }
}

Benefits:

Encryption by default
Access controls built-in
Audit logging
State versioning
Remote execution

State Access Controls

AWS IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::terraform-state-prod/infrastructure/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:DeleteItem"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:123456789:table/terraform-locks"
    },
    {
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "arn:aws:kms:us-east-1:123456789:key/12345678"
    }
  ]
}

Secrets Management Strategies

Strategy Comparison

Strategy

Security

Complexity

Cost

Hardcoded

❌ Very Low

✅ Low

✅ Free

Environment Variables

⚠️ Medium

✅ Low

✅ Free

Encrypted Files

⚠️ Medium

✅ Free

Cloud KMS

✅ High

⚠️ Medium

⚠️ Low

HashiCorp Vault

✅ Very High

❌ High

⚠️ Medium

Never Hardcode Secrets

❌ NEVER DO THIS:

variable "db_password" {
  default = "SuperSecret123!"  # NEVER!
}

resource "local_file" "config" {
  content = "password=SuperSecret123!"  # NEVER!
}

Use Sensitive Variables

variable "db_password" {
  type      = string
  sensitive = true
  description = "Database password"
}

resource "random_password" "db_password" {
  length  = 32
  special = true
}

resource "local_file" "config" {
  content = templatefile("config.tpl", {
    password = random_password.db_password.result
  })
  
  lifecycle {
    ignore_changes = [content]
  }
}

output "password_length" {
  value     = length(random_password.db_password.result)
  sensitive = false  # Length is OK to expose
}

output "password" {
  value     = random_password.db_password.result
  sensitive = true  # Never logged
}

Environment Variables

Simple secrets management for local development.

Setting Environment Variables

Linux/macOS:

export TF_VAR_db_password="SuperSecret123!"
export TF_VAR_api_key="sk-1234567890"

terraform plan

Windows PowerShell:

$env:TF_VAR_db_password = "SuperSecret123!"
$env:TF_VAR_api_key = "sk-1234567890"

terraform plan

Windows CMD:

set TF_VAR_db_password=SuperSecret123!
set TF_VAR_api_key=sk-1234567890

terraform plan

.env File (Local Only)

❌ DO NOT COMMIT .env FILES

.env:

TF_VAR_db_password=SuperSecret123!
TF_VAR_api_key=sk-1234567890

.gitignore:

.env
.env.*
*.tfvars
terraform.tfvars

Load .env:

# Load environment variables
set -a
source .env
set +a

# Run Terraform
terraform plan

Environment-Specific Secrets

secrets/
├── dev.env
├── staging.env
└── production.env  # Extra protection

Load script:

#!/bin/bash

ENV=${1:-dev}

if [ ! -f "secrets/${ENV}.env" ]; then
  echo "Error: secrets/${ENV}.env not found"
  exit 1
fi

set -a
source "secrets/${ENV}.env"
set +a

terraform workspace select "$ENV"
terraform plan

HashiCorp Vault Integration

Enterprise-grade secrets management.

What is Vault?

HashiCorp Vault provides:

Centralized secrets storage
Dynamic secrets generation
Encryption as a service
Access control
Audit logging
Secret rotation

Vault Architecture

Install Vault (Local Development)

# macOS
brew install vault

# Linux
wget https://releases.hashicorp.com/vault/1.15.0/vault_1.15.0_linux_amd64.zip
unzip vault_1.15.0_linux_amd64.zip
sudo mv vault /usr/local/bin/

# Verify
vault version

Start Vault Dev Server

# Start in dev mode (NOT for production)
vault server -dev

# In another terminal, set address
export VAULT_ADDR='http://127.0.0.1:8200'

# Use root token from server output
export VAULT_TOKEN='hvs.xxxxxxxxxxxx'

Store Secrets in Vault

# Enable KV secrets engine
vault secrets enable -path=secret kv-v2

# Store secrets
vault kv put secret/database \
  username=admin \
  password=SuperSecret123!

# Store API keys
vault kv put secret/api \
  key=sk-1234567890 \
  endpoint=https://api.example.com

# Read secrets
vault kv get secret/database

Vault Provider in Terraform

terraform {
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "~> 3.0"
    }
  }
}

provider "vault" {
  address = "http://127.0.0.1:8200"
  # Token from environment: VAULT_TOKEN
}

# Read secrets from Vault
data "vault_kv_secret_v2" "database" {
  mount = "secret"
  name  = "database"
}

data "vault_kv_secret_v2" "api" {
  mount = "secret"
  name  = "api"
}

# Use secrets
resource "local_file" "db_config" {
  filename = "database.conf"
  content  = <<-EOT
    username: ${data.vault_kv_secret_v2.database.data["username"]}
    password: ${data.vault_kv_secret_v2.database.data["password"]}
  EOT
  
  file_permission = "0600"
}

resource "local_file" "api_config" {
  filename = "api.conf"
  content  = <<-EOT
    api_key: ${data.vault_kv_secret_v2.api.data["key"]}
    endpoint: ${data.vault_kv_secret_v2.api.data["endpoint"]}
  EOT
  
  file_permission = "0600"
}

output "db_username" {
  value     = data.vault_kv_secret_v2.database.data["username"]
  sensitive = true
}

Dynamic Secrets

Vault can generate temporary credentials.

Example: Database credentials

# Enable database secrets engine
vault secrets enable database

# Configure database connection
vault write database/config/mydb \
  plugin_name=postgresql-database-plugin \
  allowed_roles="readonly" \
  connection_url="postgresql://{{username}}:{{password}}@localhost:5432/mydb" \
  username="vault" \
  password="vault-password"

# Create role
vault write database/roles/readonly \
  db_name=mydb \
  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
    GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
  default_ttl="1h" \
  max_ttl="24h"

Terraform usage:

data "vault_database_credentials" "db" {
  backend = "database"
  role    = "readonly"
}

resource "local_file" "db_creds" {
  filename = "db_creds.json"
  content  = jsonencode({
    username = data.vault_database_credentials.db.username
    password = data.vault_database_credentials.db.password
    expires  = data.vault_database_credentials.db.lease_id
  })
  
  file_permission = "0600"
}

Benefits:

Credentials expire automatically
No manual rotation needed
Unique credentials per user/service
Audit trail of all access

Sensitive Data in Terraform

Mark Variables Sensitive

variable "api_key" {
  type        = string
  sensitive   = true
  description = "API key for external service"
}

variable "db_password" {
  type        = string
  sensitive   = true
  description = "Database password"
}

Effect:

terraform plan

Output:

  # local_file.config will be created
  + resource "local_file" "config" {
      + content = (sensitive value)
      + filename = "config.yaml"
    }

Mark Outputs Sensitive

output "database_password" {
  value     = random_password.db.result
  sensitive = true
}

output "api_endpoint" {
  value     = "https://api.example.com"
  sensitive = false  # Public endpoint OK
}

Sensitive in Locals

locals {
  # Sensitive local
  connection_string = "postgresql://${var.db_user}:${var.db_password}@localhost/mydb"
}

output "connection" {
  value     = nonsensitive(length(local.connection_string))  # Length OK
  sensitive = false
}

Conditional Sensitivity

variable "password" {
  type      = string
  sensitive = true
}

output "password_hash" {
  # Hash is not sensitive
  value     = nonsensitive(sha256(var.password))
  sensitive = false
}

Encryption Patterns

Encrypt Files

Generate encryption key:

# Generate key
openssl rand -base64 32 > encryption.key

# Add to .gitignore
echo "encryption.key" >> .gitignore

Encrypt file:

# Encrypt
openssl enc -aes-256-cbc -salt \
  -in secrets.yaml \
  -out secrets.yaml.enc \
  -pass file:./encryption.key

# Decrypt
openssl enc -aes-256-cbc -d \
  -in secrets.yaml.enc \
  -out secrets.yaml \
  -pass file:./encryption.key

In Terraform:

# Read encrypted file (requires decryption first)
data "local_file" "secrets" {
  filename = "secrets.yaml"
}

locals {
  secrets = yamldecode(data.local_file.secrets.content)
}

SOPS (Secrets OPerationS)

Install:

# macOS
brew install sops

# Linux
wget https://github.com/mozilla/sops/releases/download/v3.7.3/sops-v3.7.3.linux
chmod +x sops-v3.7.3.linux
sudo mv sops-v3.7.3.linux /usr/local/bin/sops

Encrypt with SOPS:

# Create secrets file
cat > secrets.yaml <<EOF
database:
  username: admin
  password: SuperSecret123!
api:
  key: sk-1234567890
EOF

# Encrypt
sops --encrypt secrets.yaml > secrets.enc.yaml

# Decrypt
sops --decrypt secrets.enc.yaml

In Terraform:

data "sops_file" "secrets" {
  source_file = "secrets.enc.yaml"
}

resource "local_file" "config" {
  filename = "config.yaml"
  content  = yamlencode({
    database = {
      username = data.sops_file.secrets.data["database.username"]
      password = data.sops_file.secrets.data["database.password"]
    }
  })
  
  file_permission = "0600"
}

Age Encryption

Install:

brew install age

Generate key:

age-keygen -o key.txt
# Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p

Encrypt:

age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p \
  secrets.yaml > secrets.age

Decrypt:

age -d -i key.txt secrets.age

Provider Credentials Security

AWS Credentials

❌ NEVER:

provider "aws" {
  access_key = "AKIAIOSFODNN7EXAMPLE"
  secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
}

✅ Use AWS Profile:

provider "aws" {
  profile = "terraform"
  region  = "us-east-1"
}

~/.aws/credentials:

[terraform]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

✅ Use IAM Role:

provider "aws" {
  assume_role {
    role_arn = "arn:aws:iam::123456789:role/TerraformRole"
  }
}

✅ Use Environment Variables:

export AWS_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE"
export AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
export AWS_DEFAULT_REGION="us-east-1"

terraform plan

Azure Credentials

✅ Use Azure CLI:

az login
terraform plan

✅ Use Service Principal:

export ARM_CLIENT_ID="00000000-0000-0000-0000-000000000000"
export ARM_CLIENT_SECRET="secret"
export ARM_SUBSCRIPTION_ID="00000000-0000-0000-0000-000000000000"
export ARM_TENANT_ID="00000000-0000-0000-0000-000000000000"

GCP Credentials

✅ Use gcloud:

gcloud auth application-default login
terraform plan

✅ Use Service Account:

export GOOGLE_APPLICATION_CREDENTIALS="/path/to/key.json"
terraform plan

Real-World Example: Complete Security Setup

Complete production-ready security implementation.

Project Structure

secure-terraform/
├── modules/
│   └── secure-service/
│       ├── main.tf
│       ├── variables.tf
│       └── outputs.tf
├── environments/
│   ├── dev/
│   ├── staging/
│   └── production/
├── vault/
│   ├── policies/
│   │   ├── terraform-dev.hcl
│   │   ├── terraform-staging.hcl
│   │   └── terraform-prod.hcl
│   └── config/
│       └── setup.sh
├── .gitignore
├── .sops.yaml
└── README.md

Vault Setup Script

vault/config/setup.sh:

#!/bin/bash
set -e

echo "Setting up Vault for Terraform..."

# Enable KV secrets engine
vault secrets enable -path=terraform kv-v2

# Store environment-specific secrets
for env in dev staging production; do
  echo "Creating secrets for $env..."
  
  vault kv put "terraform/$env/database" \
    username="${env}_db_user" \
    password="$(openssl rand -base64 32)"
  
  vault kv put "terraform/$env/api" \
    key="$(openssl rand -hex 32)" \
    endpoint="https://api-${env}.example.com"
done

# Create policies
for env in dev staging production; do
  cat > "terraform-${env}.hcl" <<EOF
path "terraform/data/${env}/*" {
  capabilities = ["read"]
}
EOF
  
  vault policy write "terraform-${env}" "terraform-${env}.hcl"
done

# Create tokens
for env in dev staging production; do
  echo "Creating token for $env..."
  vault token create \
    -policy="terraform-${env}" \
    -ttl=24h \
    -display-name="terraform-${env}"
done

echo "✅ Vault setup complete"

Secure Module

modules/secure-service/variables.tf:

variable "environment" {
  type = string
  validation {
    condition     = contains(["dev", "staging", "production"], var.environment)
    error_message = "Environment must be dev, staging, or production."
  }
}

variable "service_name" {
  type = string
  validation {
    condition     = can(regex("^[a-z0-9-]+$", var.service_name))
    error_message = "Service name must be lowercase alphanumeric with hyphens."
  }
}

modules/secure-service/main.tf:

terraform {
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "~> 3.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.0"
    }
  }
}

# Fetch secrets from Vault
data "vault_kv_secret_v2" "database" {
  mount = "terraform"
  name  = "${var.environment}/database"
}

data "vault_kv_secret_v2" "api" {
  mount = "terraform"
  name  = "${var.environment}/api"
}

# Generate secure passwords
resource "random_password" "service_key" {
  length  = 32
  special = true
}

# Create configuration files with proper permissions
resource "local_file" "database_config" {
  filename = "${var.service_name}-database.conf"
  content  = <<-EOT
    # Database Configuration - ${var.environment}
    username: ${data.vault_kv_secret_v2.database.data["username"]}
    password: ${data.vault_kv_secret_v2.database.data["password"]}
    host: db-${var.environment}.internal
    port: 5432
  EOT
  
  file_permission = "0600"  # Owner read/write only
}

resource "local_file" "api_config" {
  filename = "${var.service_name}-api.conf"
  content  = <<-EOT
    # API Configuration - ${var.environment}
    api_key: ${data.vault_kv_secret_v2.api.data["key"]}
    endpoint: ${data.vault_kv_secret_v2.api.data["endpoint"]}
    service_key: ${random_password.service_key.result}
  EOT
  
  file_permission = "0600"
}

# Encrypted secrets file
resource "local_file" "secrets_encrypted" {
  filename = "${var.service_name}-secrets.enc"
  content = jsonencode({
    database = {
      username = data.vault_kv_secret_v2.database.data["username"]
      password_hash = sha256(data.vault_kv_secret_v2.database.data["password"])
    }
    api = {
      key_hash = sha256(data.vault_kv_secret_v2.api.data["key"])
      endpoint = data.vault_kv_secret_v2.api.data["endpoint"]
    }
    service = {
      key_hash = sha256(random_password.service_key.result)
    }
  })
  
  file_permission = "0600"
}

modules/secure-service/outputs.tf:

output "database_config_file" {
  value       = local_file.database_config.filename
  description = "Path to database configuration file"
}

output "api_config_file" {
  value       = local_file.api_config.filename
  description = "Path to API configuration file"
}

output "secrets_file" {
  value       = local_file.secrets_encrypted.filename
  description = "Path to encrypted secrets file"
}

# Only expose hashes, never actual secrets
output "password_hashes" {
  value = {
    database_password = sha256(data.vault_kv_secret_v2.database.data["password"])
    api_key          = sha256(data.vault_kv_secret_v2.api.data["key"])
    service_key      = sha256(random_password.service_key.result)
  }
  sensitive = false  # Hashes are safe
}

Environment Configuration

environments/production/main.tf:

terraform {
  required_version = ">= 1.6.0"
  
  backend "s3" {
    bucket         = "terraform-state-production"
    key            = "services/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:us-east-1:123456789:key/12345"
    dynamodb_table = "terraform-locks"
  }
  
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "~> 3.0"
    }
  }
}

provider "vault" {
  address = "https://vault.example.com"
  # Token from environment: VAULT_TOKEN
}

module "web_service" {
  source = "../../modules/secure-service"
  
  environment  = "production"
  service_name = "web"
}

module "api_service" {
  source = "../../modules/secure-service"
  
  environment  = "production"
  service_name = "api"
}

.gitignore

# Terraform
*.tfstate
*.tfstate.*
.terraform/
tfplan
.terraformrc
terraform.rc

# Secrets
*.key
*.pem
secrets/
.env
.env.*
*.tfvars

# Vault
.vault-token

# Config files with secrets
*.conf
*.enc
!*.enc.example

# OS
.DS_Store
Thumbs.db

Security Scanning

Pre-commit Hooks

Install:

pip install pre-commit

.pre-commit-config.yaml:

repos:
  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.83.0
    hooks:
      - id: terraform_fmt
      - id: terraform_validate
      - id: terraform_tflint
      - id: terraform_tfsec
  
  - repo: https://github.com/zricethezav/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks
  
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets
        args: ['--baseline', '.secrets.baseline']

Install hooks:

pre-commit install

Automated Security Scanning

#!/bin/bash
set -e

echo "🔒 Running security scans..."

# Check for secrets in code
echo "Checking for secrets..."
gitleaks detect --source . --verbose

# Security scanning
echo "Running tfsec..."
tfsec . --minimum-severity HIGH

# Compliance scanning
echo "Running Checkov..."
checkov -d . --framework terraform

echo "✅ Security scans complete"

CI/CD Security Gates

.github/workflows/security.yml:

name: Security Scan

on:
  pull_request:
  push:
    branches: [main]

jobs:
  secrets-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      
      - name: GitLeaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Run tfsec
        uses: aquasecurity/[email protected]
        with:
          soft_fail: false
      
      - name: Run Checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: .
          framework: terraform
          soft_fail: false

Compliance and Auditing

Audit Logging

Enable CloudTrail (AWS):

resource "aws_cloudtrail" "terraform_audit" {
  name           = "terraform-audit"
  s3_bucket_name = aws_s3_bucket.audit_logs.id
  
  enable_logging = true
  
  event_selector {
    read_write_type           = "All"
    include_management_events = true
  }
}

Vault Audit Logging:

vault audit enable file file_path=/var/log/vault-audit.log

Compliance Frameworks

CIS Benchmarks:

checkov -d . --framework terraform --check CIS_AWS

SOC 2:

Audit all state access
Encrypt all data
Implement access controls
Log all changes

HIPAA:

Encrypt PHI
Access controls
Audit trails
Data retention

GDPR:

Data encryption
Access logging
Right to deletion
Data residency

Compliance as Code

Policy (compliance.rego):

package terraform.compliance

# All resources must have required tags
deny[msg] {
  resource := input.resource_changes[_]
  not resource.change.after.tags["Environment"]
  msg := sprintf("Resource %s missing Environment tag", [resource.address])
}

deny[msg] {
  resource := input.resource_changes[_]
  not resource.change.after.tags["Owner"]
  msg := sprintf("Resource %s missing Owner tag", [resource.address])
}

# Production resources must have backup enabled
deny[msg] {
  resource := input.resource_changes[_]
  resource.change.after.tags["Environment"] == "production"
  resource.change.after.backup_enabled == false
  msg := sprintf("Production resource %s must have backups", [resource.address])
}

# No public access in production
deny[msg] {
  resource := input.resource_changes[_]
  resource.change.after.tags["Environment"] == "production"
  resource.change.after.public_access == true
  msg := sprintf("Production resource %s cannot be publicly accessible", [resource.address])
}

Secret Rotation

Automated Rotation

# Rotate passwords monthly
resource "random_password" "db_password" {
  length  = 32
  special = true
  
  keepers = {
    # Rotate on the 1st of each month
    rotation = formatdate("YYYY-MM", timestamp())
  }
}

# Store in Vault
resource "vault_kv_secret_v2" "db_password" {
  mount = "secret"
  name  = "database/password"
  
  data_json = jsonencode({
    password    = random_password.db_password.result
    rotated_at  = timestamp()
  })
}

Manual Rotation Process

1. Generate new secret:

vault kv put secret/database/password \
  password="$(openssl rand -base64 32)" \
  rotated_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"

2. Run Terraform:

terraform apply

3. Verify:

vault kv get secret/database/password

4. Update dependent services

5. Remove old secret

Common Security Mistakes

Mistake 1: Committing Secrets

Problem:

git add terraform.tfvars
git commit -m "Add configuration"

Solution:

# .gitignore
*.tfvars
.env
secrets/

Mistake 2: Unencrypted State

Problem:

terraform {
  backend "s3" {
    bucket = "terraform-state"
    key    = "terraform.tfstate"
    # No encryption!
  }
}

Solution:

terraform {
  backend "s3" {
    bucket     = "terraform-state"
    key        = "terraform.tfstate"
    encrypt    = true
    kms_key_id = "arn:aws:kms:..."
  }
}

Mistake 3: Over-Privileged Access

Problem:

{
  "Effect": "Allow",
  "Action": "*",
  "Resource": "*"
}

Solution:

{
  "Effect": "Allow",
  "Action": [
    "s3:GetObject",
    "s3:PutObject"
  ],
  "Resource": "arn:aws:s3:::terraform-state/*"
}

Mistake 4: Logging Sensitive Data

Problem:

output "database_password" {
  value = var.db_password
  # Not marked sensitive!
}

Solution:

output "database_password" {
  value     = var.db_password
  sensitive = true
}

Mistake 5: No Audit Trail

Problem: No logging of who accessed what when.

Solution:

Enable CloudTrail
Enable Vault audit logging
Log Terraform operations
Monitor access patterns

Security Best Practices

1. Never Commit Secrets

✅ Use Vault or similar ✅ Use environment variables ✅ Encrypt files ✅ Use .gitignore ❌ Never hardcode

2. Encrypt Everything

✅ State at rest ✅ State in transit ✅ Secrets storage ✅ Configuration files

3. Least Privilege

✅ Minimal permissions ✅ Time-limited access ✅ Role-based access ✅ Regular audits

4. Audit Everything

✅ Log all access ✅ Monitor patterns ✅ Alert on anomalies ✅ Regular reviews

5. Rotate Regularly

✅ Automate rotation ✅ Short-lived credentials ✅ Track rotation dates ✅ Test rotation process

6. Scan Continuously

✅ Pre-commit hooks ✅ CI/CD scanning ✅ Regular audits ✅ Dependency updates

7. Defense in Depth

✅ Multiple security layers ✅ Assume breach ✅ Verify everything ✅ Continuous improvement

What I Learned About Infrastructure Security

1. Security is Not Optional

That Tuesday morning AWS incident taught me: one leaked credential can destroy everything.

Security must be baked in from day one.

2. State Files Are Treasure Troves

State contains every secret in your infrastructure.

Treat state files like the crown jewels.

3. Automation Prevents Human Error

Manual secret management fails.

Automated systems (Vault, KMS) work.

4. Visibility Enables Security

You can't secure what you can't see.

Logging and monitoring are essential.

5. Compliance is Easier with Code

Policy as code enforces compliance automatically.

Manual checks don't scale.

6. Least Privilege Works

Give minimum permissions needed.

Over-privileged access is a liability.

7. Security is Continuous

Security is not a one-time setup.

Continuous scanning, rotation, and improvement.

Next Steps

Congratulations! You've mastered Terraform security:

✅ Securing state files ✅ Secrets management strategies ✅ HashiCorp Vault integration ✅ Encryption patterns ✅ Provider credentials security ✅ Security scanning ✅ Compliance and auditing ✅ Secret rotation

Practice Exercises

Exercise 1: Secure Your State

1. Move to encrypted remote backend
2. Enable state locking
3. Configure access controls
4. Test state recovery

Exercise 2: Implement Vault

1. Set up Vault server
2. Store secrets in Vault
3. Update Terraform to use Vault
4. Test secret rotation

Exercise 3: Security Scanning

1. Install security scanners
2. Run full security scan
3. Fix all issues
4. Add to CI/CD pipeline

Coming Up Next

In Article 10: Advanced Modules and Composition - Building Complex Infrastructure, we'll explore:

Complex module patterns
Module composition strategies
Mono-repo vs multi-repo
Module versioning strategies
Registry best practices
Testing complex modules

Security protects your infrastructure. Advanced modules organize it.

This Week's Challenge: Audit your Terraform projects for security issues. Encrypt state, remove hardcoded secrets, implement Vault or similar secrets management.

See you in Article 10! 🔒

"That AWS credential leak cost us $4,000 and 72 hours of crisis management. Now every secret goes through Vault, every state file is encrypted, and we sleep better at night." - Me, security-first now

PreviousTesting and Validation NextAdvanced Module Patterns for Enterprise Scale

Last updated 1 month ago

hashtagTable of Contents

hashtagIntroduction: The Security Incident

hashtagWhy Infrastructure Security Matters

hashtagAttack Surface

hashtagCommon Attack Vectors

hashtagThe Cost of Insecurity

hashtagSecurity Principles for Terraform

hashtag1. Least Privilege

hashtag2. Defense in Depth

hashtag3. Zero Trust

hashtag4. Immutable Infrastructure

hashtagSecuring Terraform State

hashtagWhat's in State?

hashtagState Security Checklist

hashtagSecure Remote Backend (S3)

hashtagSecure Remote Backend (Terraform Cloud)

hashtagState Access Controls

hashtagSecrets Management Strategies

hashtagStrategy Comparison

hashtagNever Hardcode Secrets

hashtagUse Sensitive Variables

hashtagEnvironment Variables

hashtagSetting Environment Variables

hashtag.env File (Local Only)

hashtagEnvironment-Specific Secrets

hashtagHashiCorp Vault Integration

hashtagWhat is Vault?

hashtagVault Architecture

hashtagInstall Vault (Local Development)

hashtagStart Vault Dev Server

hashtagStore Secrets in Vault

hashtagVault Provider in Terraform

hashtagDynamic Secrets

hashtagSensitive Data in Terraform

hashtagMark Variables Sensitive

hashtagMark Outputs Sensitive

hashtagSensitive in Locals

hashtagConditional Sensitivity

hashtagEncryption Patterns

hashtagEncrypt Files

hashtagSOPS (Secrets OPerationS)

hashtagAge Encryption

hashtagProvider Credentials Security

hashtagAWS Credentials

hashtagAzure Credentials

hashtagGCP Credentials

hashtagReal-World Example: Complete Security Setup

hashtagProject Structure

hashtagVault Setup Script

hashtagSecure Module

hashtagEnvironment Configuration

hashtag.gitignore

hashtagSecurity Scanning

hashtagPre-commit Hooks

hashtagAutomated Security Scanning

hashtagCI/CD Security Gates

hashtagCompliance and Auditing

hashtagAudit Logging

hashtagCompliance Frameworks

hashtagCompliance as Code

hashtagSecret Rotation

hashtagAutomated Rotation

hashtagManual Rotation Process

hashtagCommon Security Mistakes

hashtagMistake 1: Committing Secrets

hashtagMistake 2: Unencrypted State

hashtagMistake 3: Over-Privileged Access

hashtagMistake 4: Logging Sensitive Data

hashtagMistake 5: No Audit Trail

hashtagSecurity Best Practices

hashtag1. Never Commit Secrets

hashtag2. Encrypt Everything

hashtag3. Least Privilege

hashtag4. Audit Everything

hashtag5. Rotate Regularly

hashtag6. Scan Continuously

hashtag7. Defense in Depth

hashtagWhat I Learned About Infrastructure Security

hashtag1. Security is Not Optional

hashtag2. State Files Are Treasure Troves

Table of Contents

Introduction: The Security Incident

Why Infrastructure Security Matters

Attack Surface

Common Attack Vectors

The Cost of Insecurity

Security Principles for Terraform

1. Least Privilege

2. Defense in Depth

3. Zero Trust

4. Immutable Infrastructure

Securing Terraform State

What's in State?

State Security Checklist

Secure Remote Backend (S3)

Secure Remote Backend (Terraform Cloud)

State Access Controls

Secrets Management Strategies

Strategy Comparison

Never Hardcode Secrets

Use Sensitive Variables

Environment Variables

Setting Environment Variables

.env File (Local Only)

Environment-Specific Secrets

HashiCorp Vault Integration

What is Vault?

Vault Architecture

Install Vault (Local Development)

Start Vault Dev Server

Store Secrets in Vault

Vault Provider in Terraform

Dynamic Secrets

Sensitive Data in Terraform

Mark Variables Sensitive

Mark Outputs Sensitive

Sensitive in Locals

Conditional Sensitivity

Encryption Patterns

Encrypt Files

SOPS (Secrets OPerationS)

Age Encryption

Provider Credentials Security

AWS Credentials

Azure Credentials

GCP Credentials

Real-World Example: Complete Security Setup

Project Structure

Vault Setup Script

Secure Module

Environment Configuration

.gitignore

Security Scanning

Pre-commit Hooks

Automated Security Scanning

CI/CD Security Gates

Compliance and Auditing

Audit Logging

Compliance Frameworks

Compliance as Code

Secret Rotation

Automated Rotation

Manual Rotation Process

Common Security Mistakes

Mistake 1: Committing Secrets

Mistake 2: Unencrypted State

Mistake 3: Over-Privileged Access

Mistake 4: Logging Sensitive Data

Mistake 5: No Audit Trail

Security Best Practices

1. Never Commit Secrets

2. Encrypt Everything

3. Least Privilege

4. Audit Everything

5. Rotate Regularly

6. Scan Continuously

7. Defense in Depth

What I Learned About Infrastructure Security

1. Security is Not Optional

2. State Files Are Treasure Troves