Originally published on kuryzhev.cloud
Your Terraform state file might already be leaking every Vault secret you've ever provisioned — plaintext, unencrypted, and one terraform state show away from disaster. I've audited enough Terraform vault secrets setups to know this isn't a hypothetical. It's the default behavior, and most teams don't find out until a state file ends up in the wrong S3 bucket or a contractor's laptop. Here are seven things I do differently now, after learning some of these the hard way.
Treat Terraform state as a secret, because it stores Vault data in plaintext
This is the one nobody reads the docs for until it's too late. Resources like vault_kv_secret_v2 and vault_generic_secret write the raw secret value directly into .tfstate — no field-level encryption, no redaction, nothing. If someone can read your state file, they don't need Vault access at all.
Marking an output as sensitive = true only hides it from CLI output and plan diffs — the state file itself still contains the plaintext value. The only real fix is an encrypted remote backend: S3 with SSE-KMS, or Terraform Cloud's managed encrypted storage. And don't stop at bucket policy — lock down IAM so only your pipeline role can read that object.
