Terraform Security

Terraform includes multiple security layers including state file encryption, secrets management via HashiCorp Vault integration, Sentinel policy enforcement, and the principle of least privilege through provider configurations.

Remote state backends (S3, Azure Blob, GCS, Consul, Terraform Cloud) provide encryption at rest. State locking prevents concurrent modifications. Terraform Cloud/Enterprise adds encryption in transit, access controls, and audit logging. Sensitive outputs are redacted in CLI output.

Sensitive variables marked with sensitive = true are redacted from plan/apply output. HashiCorp Vault integration provides dynamic secrets (database credentials, API keys, certificates). Terraform Cloud/Enterprise integrates with Vault for secret injection. External secrets via Vault, AWS Secrets Manager, Azure Key Vault.

Sentinel (Enterprise) provides policy-as-code for infrastructure governance. Policies can restrict resource types, enforce tagging, mandate encryption, prevent public exposure, and enforce naming conventions. OPA integration for open-source policy enforcement. Run tasks integrate third-party policy tools.

Official providers maintained by HashiCorp and cloud vendors undergo security review. Provider version pinning prevents unexpected changes. Provider signing and verification. Private registry for curated, approved providers. Drift detection alerts on manual changes.

Terraform Enterprise supports SOC 2, ISO 27001, FedRAMP. Audit logging for all runs and user actions. SAML/SSO, SCIM provisioning. Private module registry ensures only approved patterns. Cost estimation prevents budget overruns.