Your Terraform state file is a plaintext secrets store. Mine was too.

Short summary

Terraform state files store plaintext secrets—RDS passwords, tokens, database credentials—exposing them to any tool that reads or persists the file. Detect sensitive fields via key-name pattern matching (password, secret, token, access_key) and scrub at ingestion, not render time. Over-masking is safer than under-masking; false positives cost nothing, but missing a secret is a one-directional security failure.

• •Terraform state files contain plaintext secrets (RDS passwords, tokens, database credentials) readable by any tool that processes them
• •Detect sensitive fields via lowercased key-name pattern matching and scrub at ingestion boundary, before storage or logs
• •Over-masking is safer than under-masking—plaintext values aren't needed for diffs, but missed secrets enable breaches

Generated with AI, which can make mistakes.