Find the secrets in your own Terraform state

short · 50 min · Objective 2.1

Task

Generate infrastructure state containing a sensitive value, demonstrate that marking the variable sensitive does not remove it, and then secure the state properly.

Steps

  1. Write a small configuration that creates a resource with a generated password, marking the variable or output as sensitive.
  2. Apply it locally, then search the state file for the plaintext value and capture the result in lab/state-leak.txt.
  3. Move state to a remote backend that is access-controlled, encrypted and versioned, with locking enabled. Record the backend configuration in lab/state-backend.md.
  4. Add the state file and any local override files to version control's ignore rules, and prove it: attempt to stage the state file and capture the refusal in lab/state-ignored.txt.
  5. Re-source the secret from a secrets manager at apply time instead of passing it as an input, and confirm the new state no longer contains it.

Verify

grep -c . lab/state-leak.txt
grep -Eci 'encrypt|lock|version' lab/state-backend.md
test -s lab/state-ignored.txt && echo "ignore rule proven"

The leak file NON-EMPTY -- you found the plaintext in state despite the sensitive marking -- the backend documented with all three properties, and the ignore rule demonstrated rather than assumed. If the leak file is empty, you did not search the raw state; look at the resource attributes, not the outputs.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.