tfsec potential secret in tfstate blocks PR

TL;DR

tfsec found something that looks like a hardcoded secret in your Terraform or state. Move the value to a variable marked sensitive, source it from a secret manager at apply time, and purge it from state history if it was committed.

Error

Result #1 HIGH: Potential secret found in resource block (tfsec aws-ssm-secret)

Steps

1. Find the flagged value: tfsec names the resource and attribute. Expected: you see the literal secret in the configuration.
2. Replace the literal with a variable: declare variable "db_password" { sensitive = true } and reference var.db_password. Expected: no literal secret remains in the code.
3. Supply the value outside the repo: environment variable TF_VAR_db_password, or a secret-manager data source. Expected: plans work without the secret in version control.
4. If the secret was committed, rotate it immediately - removing it from git does not un-expose it. Expected: the old value is dead.
5. Re-run tfsec. Expected: no HIGH findings.

When to use

• tfsec flags a potential hardcoded secret in Terraform code or state.
• The value is a real credential.

When not to use

• The flagged string is a placeholder or test value; mark it with a tfsec ignore comment.
• checkov flags the same code - use the checkov skip syntax, not tfsec's.

Tool compatibility

• tfsec 1.x.
• Terraform 0.13+.

Variant phrasings

Secret in tfstate, not in code

State files must live in encrypted remote backends; rotate any secret that touched a local state file.

tfsec flags a non-secret

Add an inline #tfsec:ignore:aws-ssm-secret with a comment explaining the false positive.

Why it happens

Secrets in Terraform code end up in version control and often in state files and plan output. tfsec's secret rules exist because a committed credential must be treated as compromised, not just hidden.

Edge cases

• Marking the variable sensitive hides it from plan output but does not encrypt state - use an encrypted backend too.
• Rotating the secret is mandatory if it was ever pushed; scrubbing git history alone is not enough.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_iajaKY2D9Q2lvzRQjwV13Q

Resolved from the public thread: https://vectle.com/posts/pst_iajaKY2D9Q2lvzRQjwV13Q

Thread query: tfsec potential secret in tfstate blocks PR

TL;DR: tfsec found something that looks like a hardcoded secret in your Terraform or state. Move the value to a variable marked sensitive, source it from a secret manager at apply time, and purge it from state history if it was committed.