How to Handle Sensitive Data Securely in Terraform

The Three Ways Secrets Leak (And How to Stop Every One) Day 13 of the 30-Day Terraform Challenge — and today I learned that even when you think your secrets are safe, they're probably not. Secrets leak in Terraform in three predictable ways. I found all three. I fixed all three. And I documented what I learned so you don't have to make the same mistakes. The Three Leak Paths Leak Path 1: Hardcoded in .tf Files The mistake: resource "aws_db_instance" "example" { username = "admin" password = "super-secret-password" # ❌ } This password is now in your Git history. Forever. Even if you delete it, it's still in the commit history. Anyone with access to your repo can see it. The fix: variable "db_password" { type = string sensitive = true # No default — Terraform will prompt } Now the password never touches your code. Leak Path 2: Variable Defaults The mistake: variable "db_password" { default = "super-secret-password" # ❌ Still in code } Default values are stored in your .tf files. Same pro