Also, Terraform stores "all settings, including usernames, passwords, port numbers and literally everything else" in the tfstate file (1). I believe that using

Also, Terraform stores "all settings, including usernames, passwords, port numbers and literally everything else" in the tfstate file (1). I believe that using Dynamic Secrets is HashiCorp's proposal for how to mitigate this; leave the secrets in the log files, but make sure they expire in a timely manner. [1] https://tosbourn.com/hiding-secrets-terraform/ https://tosbourn.com/hiding-secrets-terraform/