Skip to main content
RunBook Academy

← All checklists in Terraform

Quarterlyterraform-secrets

Secrets Management Checklist

10 items ·7 critical ·3 warn ·0 info

Purpose

This checklist verifies the secrets are correctly managed in a Terraform estate. Run through every item quarterly to ensure secrets are not exposed.

Checklist

  • No secrets are hard-coded in .tf files. (critical)
  • No secrets are in .tfvars files committed to Git. (critical)
  • Sensitive variables are marked sensitive = true. (warn)
  • Secrets are read from a secrets manager (AWS Secrets Manager, HashiCorp Vault, etc.). (critical)
  • The secrets manager is access-controlled (least-privilege). (critical)
  • The secrets manager is logged and audited. (warn)
  • The CI pipeline uses short-lived credentials (OIDC, workload identity). (critical)
  • No secrets are in the CI pipeline logs (plan output is redacted). (critical)
  • Secret rotation is performed regularly. (critical)
  • Secret rotation is audited and verified. (warn)

Verification

The checklist is complete when every item is checked. A critical item unchecked is a security incident.

Escalation

If a critical item cannot be satisfied, escalate to the security team.

Critical7 items

Warning3 items