How do you manage secrets and avoid them leaking in Terraform?
⚡
Quick Answer
Never hard-code secrets; source them from a secret manager, mark outputs sensitive, and protect state (it stores secrets in plaintext).
Detailed Answer
Terraform state records resource attributes including secrets in plaintext, so encrypt and lock down the backend. Pull secrets at apply time from Vault/SSM rather than committing them, mark variables/outputs sensitive = true to keep them out of logs, and restrict who can read state.
💡
Interview Tip
Key point: state holds secrets in plaintext — protect it.
terraformsecretssensitive