Terraform State Files Silently Expose HashiCorp Vault Secrets in Plaintext

Terraform state files store Vault secrets in plaintext by default, meaning anyone with read access to the state file can retrieve sensitive data without needing Vault credentials. Resources such as vault_kv_secret_v2 and vault_generic_secret write raw secret values directly into .tfstate with no encryption or redaction. Security practitioners recommend using an encrypted remote backend — such as AWS S3 with SSE-KMS — and restricting IAM access to pipeline roles only. Hardcoded Vault tokens in provider blocks pose an additional risk, as private repositories can be forked, mirrored, or exposed through CI logs; AppRole authentication with regularly rotated credentials is advised instead. Terraform 1.10 introduced ephemeral resources that are never persisted to state or plan files, offering a more robust solution for keeping secrets out of stored infrastructure records.