Keeping Terraform Vault Secrets Out of State and Git

Using the vault_kv_secret_v2 data source to pull database passwords into Terraform stores those values in plain-text state, even when variables are marked sensitive. Newer Terraform and Vault provider releases offer ephemeral resources and write-only arguments, which keep secrets available during a run without persisting them in plan or state. The approach requires Terraform 1.10 or 1.11 or later, a KV version 2 secrets engine in Vault, and a non-interactive authentication method such as AppRole or JWT. Users should configure the Vault provider without hard-coded tokens, reading credentials from the environment or auth blocks. Support for write-only arguments varies by provider and resource, so the guide advises checking each provider's documentation before relying on it.