Purpose
This checklist verifies the secrets are correctly managed in a Terraform estate. Run through every item quarterly to ensure secrets are not exposed.
Checklist
- No secrets are hard-coded in
.tffiles. (critical) - No secrets are in
.tfvarsfiles committed to Git. (critical) - Sensitive variables are marked
sensitive = true. (warn) - Secrets are read from a secrets manager (AWS Secrets Manager, HashiCorp Vault, etc.). (critical)
- The secrets manager is access-controlled (least-privilege). (critical)
- The secrets manager is logged and audited. (warn)
- The CI pipeline uses short-lived credentials (OIDC, workload identity). (critical)
- No secrets are in the CI pipeline logs (plan output is redacted). (critical)
- Secret rotation is performed regularly. (critical)
- Secret rotation is audited and verified. (warn)
Verification
The checklist is complete when every item is checked. A
critical item unchecked is a security incident.
Escalation
If a critical item cannot be satisfied, escalate to the security team.