Secrets hygiene is the discipline of ensuring that sensitive values — database passwords, API keys, TLS private keys, OAuth tokens, and service credentials — never appear in places they should not. In Terraform, this means never hardcoding secrets in .tf files or .tfvars files that get committed to version control, never letting Terraform store secrets in state files without encryption, and never passing secrets through environment variables that might be logged in CI output. The consequences of poor secrets hygiene in IaC are severe and often delayed: a database password committed to a public GitHub repository may be exploited weeks later after a malicious scanner discovers it, a secret in a CI log may sit unnoticed until a security audit, and a secret in an unencrypted state file shared via Slack is a credential exposure waiting to happen. The 2022 Toyota data breach and the 2019 Capital One breach both involved credentials exposed through insecure code or configuration — patterns that disciplined secrets hygiene prevents entirely.
Terraform interacts with secrets in three distinct ways, each requiring a different hygiene approach. First, Terraform needs secrets to authenticate with cloud providers (AWS credentials, Azure service principal) — these should be injected as environment variables or via cloud-native credential mechanisms (IAM roles, OIDC), never hardcoded. Second, Terraform creates resources that generate or store secrets (RDS passwords, TLS certificates) — these should be created by Terraform using the 'random_password' resource or external secret generation, stored in a secrets manager service, and referenced by ARN in downstream resources rather than stored raw in state. Third, Terraform reads existing secrets to configure resources (fetching a database URL to pass to an application) — this pattern stores the secret in state and should be replaced with ARN-based references wherever possible. Understanding which category each secret falls into determines the correct hygiene approach.