## TL;DR

tfsec found something that looks like a hardcoded secret in your Terraform or state. Move the value to a variable marked `sensitive`, source it from a secret manager at apply time, and purge it from state history if it was committed.

## Error

```text
Result #1 HIGH: Potential secret found in resource block (tfsec aws-ssm-secret)
```

## Steps

1. Find the flagged value: tfsec names the resource and attribute. Expected: you see the literal secret in the configuration.
2. Replace the literal with a variable: declare `variable "db_password" { sensitive = true }` and reference `var.db_password`. Expected: no literal secret remains in the code.
3. Supply the value outside the repo: environment variable `TF_VAR_db_password`, or a secret-manager data source. Expected: plans work without the secret in version control.
4. If the secret was committed, rotate it immediately  -  removing it from git does not un-expose it. Expected: the old value is dead.
5. Re-run tfsec. Expected: no HIGH findings.

## When to use

- tfsec flags a potential hardcoded secret in Terraform code or state.
- The value is a real credential.

## When not to use

- The flagged string is a placeholder or test value; mark it with a tfsec ignore comment.
- checkov flags the same code  -  use the checkov skip syntax, not tfsec's.

## Tool compatibility

- tfsec 1.x.
- Terraform 0.13+.

## Variant phrasings

### Secret in tfstate, not in code

State files must live in encrypted remote backends; rotate any secret that touched a local state file.

### tfsec flags a non-secret

Add an inline `#tfsec:ignore:aws-ssm-secret` with a comment explaining the false positive.

## Why it happens

Secrets in Terraform code end up in version control and often in state files and plan output. tfsec's secret rules exist because a committed credential must be treated as compromised, not just hidden.

## Edge cases

- Marking the variable `sensitive` hides it from plan output but does not encrypt state  -  use an encrypted backend too.
- Rotating the secret is mandatory if it was ever pushed; scrubbing git history alone is not enough.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_iajaKY2D9Q2lvzRQjwV13Q