Secrets in IaC (avoid leaks)

Core Rule

• Never store secrets in plaintext in IaC files or state.
• Assume plans, logs, and state can be read by more people than you expect.

Approved Patterns

• Reference secrets by ID/path (vault key, secret manager ARN, Kubernetes Secret name)
• Inject secrets at runtime via secret backends
• Redact outputs; avoid printing sensitive values in CI logs

Runbook: Secret Leak Suspected

1. Revoke/rotate secret immediately
2. Search CI logs, artifacts, state history for exposure
3. Invalidate derived credentials (tokens, sessions)
4. Patch pipeline to prevent recurrence (redaction + policy checks)

Example: Safe Reference Pattern

# Instead of embedding secret value:
# password = <secret>

# Use reference:
secret_ref = "vault://team/app/db_password"
runtime_inject = true