Where Secrets Travel

Scenario: A password never appears in Git, yet it is exposed in state, a saved plan, debug logs, and a CI artifact.

Trace secret flow end to end: source, variable injection, expression, provider request, remote API, state, output, plan, logs, caches, and backups. sensitive redacts selected presentation, while ephemeral capabilities in supported Terraform versions can omit appropriate values from state/plan when the provider and context allow. Prefer references to secret-manager objects and short-lived credentials over transporting secret values through Terraform.

Analogy: Redaction is covering a label on a parcel; data minimization is never putting the secret in the parcel.

A worked configuration

variable "token" {
  type      = string
  sensitive = true
}
# Prefer a provider data source or workload identity when possible.

Classify state and plans as secret-bearing by default. Encrypt at rest and in transit, tightly scope read access, set retention, sanitize logs, and prevent artifact publication to pull requests from untrusted forks.

Note: Treat the plan as a change contract: understand every create, update, replacement, and destroy before approving it.

Goal: Reinforce this lesson in the tf-sensitive-outputs Terraform lab. Open /labs/terraform and choose slug tf-sensitive-outputs; the lab runs real Terraform against the offline FakeCloud provider.