How to Manage Secrets and Sensitive Data in Terraform

Name: Ansible Automation Platform By Example
Author: Luca Berton

Best practices for managing secrets, passwords, and sensitive data in Terraform configurations.

How to Manage Secrets and Sensitive Data in Terraform

March 1, 2026
2 min read
Posted by Luca Berton
secrets, sensitive, security, vault

The Problem With Secrets in Terraform

Terraform state files contain sensitive data in plain text. API keys, database passwords, and certificates stored in state are readable by anyone with state access. Here’s how to handle this securely.

Rule 1: Never Hardcode Secrets

# BAD - secret in code
resource "aws_db_instance" "db" {
  password = "super-secret-password"  # This ends up in state AND git
}

# GOOD - use a variable
resource "aws_db_instance" "db" {
  password = var.db_password
}

Method 1: Environment Variables

export TF_VAR_db_password="super-secret-password"
terraform apply

Method 2: AWS Secrets Manager

data "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "prod/database/password"
}

resource "aws_db_instance" "db" {
  password = data.aws_secretsmanager_secret_version.db_password.secret_string
}

Method 3: HashiCorp Vault

provider "vault" {
  address = "https://vault.example.com"
}

data "vault_generic_secret" "db" {
  path = "secret/data/prod/database"
}

resource "aws_db_instance" "db" {
  password = data.vault_generic_secret.db.data["password"]
}

Method 4: SOPS Encrypted Files

# Encrypt a tfvars file
sops --encrypt --in-place secrets.tfvars

# Decrypt and apply
sops -d secrets.tfvars | terraform apply -var-file=/dev/stdin

Marking Outputs as Sensitive

output "db_connection_string" {
  value     = "postgresql://${var.db_user}:${var.db_password}@${aws_db_instance.db.endpoint}"
  sensitive = true
}

variable "db_password" {
  type      = string
  sensitive = true  # Prevents value from showing in plan output
}