Many developers, myself included, often think that terraform.tfvars is a safe place to store secrets.
Some even believe that simply adding it to .gitignore is enough to be safe.
The reality is different:
terraform.tfvars is just a plain text input file with no encryption or special protection. It is not a vault and provides no guarantee against leaks.
Myth vs. reality
Is it a secret file? It is plain text
Is it safe if I put it in .gitignore? It will still exist on disk and can leak
Perfect for passwords? Only if you don't mind them being exposed
What is it for then?
A convenience service. It makes it easier to pass variables without typing long -var options every time. It is ideal for development and testing, but it was not designed to store secrets in production.
Best practices
Do not store credentials or sensitive secrets in tfvars files. Use secret managers such as HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault, repository encryption with tools like SOPS or git-crypt, sensitive variables in Terraform Cloud, or use AI agents and secure mechanisms at the application layer.
At Q2BSTUDIO we help implement secure, custom solutions: we develop custom applications and custom software with a focus on cybersecurity, artificial intelligence, and integration with AWS and Azure cloud services. We offer business intelligence services and solutions with Power BI, AI agents, and AI for businesses to automate processes and protect sensitive data.
If you need to audit pipelines, migrate secrets to a centralized manager, design a secure architecture on AWS or Azure, or create a secure and scalable application, at Q2BSTUDIO we combine experience in custom software, artificial intelligence, and cybersecurity to offer a comprehensive solution.
Conclusion
Terraform.tfvars improves the development and testing experience but does not guarantee security. Treat it as a convenience file and use mechanisms designed to protect secrets when working in real environments.
