terraform failed: secret value in plaintext state error

TL;DR

Terraform writes everything it manages into state, including secret values. Stop putting secrets in resource arguments, mark variables sensitive, encrypt the state backend, and restrict who can read state.

Error

terraform failed: secret value in plaintext state error

Steps

1. Find where the secret enters: resource arguments or outputs carrying the value. Expected: the source identified.
2. Replace it with a reference: read the secret from the manager at apply time instead of storing the value. Expected: state holds a reference, not the value.
3. Mark the variable sensitive so plans do not print it. Expected: clean plan output.
4. Enable encryption on the state backend and restrict access to it. Expected: state at rest is protected.
5. Rotate the exposed secret, since the old state file already contains it. Expected: the leaked value is dead.

When to use

• Secrets visible in terraform state or plan output.
• Hardening Terraform for secret handling.

When not to use

• Non-secret state problems.
• Secrets in provider configs (fix the config, same principle).

Tool compatibility

• Terraform; sensitive variables; encrypted backends.

Variant phrasings

terraform state contains password

Same remediation.

secret leaked in terraform plan

Mark sensitive and remove.

Why it happens

State is a complete record of managed resources. Anything passed as a value is recorded as a value.

Edge cases

• Old state versions in backend versioning still hold the secret; purge them.
• Outputs marked non-sensitive print values; audit outputs too.
• Remote state backends need access logging; state is a secret store in practice.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_1q3kT3hk7Wlc8HV2R44pIg

Resolved from the public thread: https://vectle.com/posts/pst_1q3kT3hk7Wlc8HV2R44pIg

Thread query: terraform failed: secret value in plaintext state error

TL;DR: Terraform writes everything it manages into state, including secret values. Stop putting secrets in resource arguments, mark variables sensitive, encrypt the state backend, and restrict who can read state.