Security Failures and Recovery

Scenario: A secret is printed in CI and Terraform state may contain it; deleting the log feels like remediation.

First revoke or rotate the exposed credential. Then contain access, preserve appropriate audit evidence, identify every copy—state versions, plans, logs, caches, backups—and remediate retention. Remove the value from configuration and redesign injection. State surgery is risky and cannot revoke a secret; use supported state replacement/migration procedures and coordinate with backend administrators.

Analogy: If a house key is photographed, deleting the photo album does not secure the house. Change the lock first, then find every copy and fix the handling process.

A worked configuration

# Incident sequence (conceptual):
# 1 revoke/rotate  2 contain  3 inventory copies
# 4 redesign flow   5 sanitize/expire artifacts  6 verify

Practice response before an incident: know backend versioning, access logs, artifact retention, credential owners, and escalation paths. Prevention and rapid rotation matter more than pretending secrets can never leak.

Warning: Do not paste Terraform debug logs, state fragments, or plan JSON into public issue trackers. Sanitize locally and share through an approved sensitive channel.

Goal: Reinforce this lesson in the tf-sensitive-outputs Terraform lab. Open /labs/terraform and choose slug tf-sensitive-outputs; the lab runs real Terraform against the offline FakeCloud provider.