Cloud Computing, DevOps

3 Mins Read

Terraform Security Practices and Integration with Hashicorp Vault


Terraform has become an indispensable tool for automating infrastructure provisioning in today’s dynamic cloud environment. However, with great skills comes great responsibility, especially in security practices. In this blog post, we’ll explore essential security practices for Terraform deployments to ensure the safety of your infrastructure and sensitive data.

Leveraging Terraform's Sensitive Attribute

Terraform provides a sensitive attribute that can be applied to variables and outputs. By marking certain variables as sensitive, Terraform ensures that their values are not displayed in the console output or stored in the state file. This is crucial for protecting sensitive information such as passwords, access keys, or tokens from being exposed unintentionally.



Want to save money on IT costs?

  • Migrate to cloud without hassles
  • Save up to 60%
Get Started with Free AWS Credits

Remote Backend

Using a remote backend to store Terraform state files is recommended for improved security and collaboration. Remote backends like Amazon S3, Azure Blob Storage, or HashiCorp Terraform Cloud offer features such as encryption, access control, and versioning, which enhance the overall security posture of your infrastructure.

Example configuration for using an S3 backend:


Environment Variables

Avoid hardcoding sensitive information directly into Terraform configuration files. Instead, leverage environment variables to pass sensitive data securely. This practice enhances security and promotes portability and flexibility across different environments.


Store Sensitive Data in a Secret Management System

HashiCorp Vault: HashiCorp Vault is a powerful tool that integrates seamlessly with Terraform for managing secrets and sensitive data. Vault provides robust encryption, access control, and dynamic secrets management capabilities, ensuring that sensitive information is stored securely and accessed only by authorized entities.

Step-by-step guide to setting up the Hashicorp vault server with integration:

First, Create an AWS EC2 instance with Ubuntu, you have two primary options: through the AWS Management Console or via the AWS CLI. Once you are ready with a EC2 server with ubuntu OS you can start installing hashicorp vault on the same

Now, to install Vault on the EC2 instance, follow these steps:

  • Install gpg using command : sudo apt update && sudo apt install gpg.
  • Download the signing key: wget -O- | sudo gpg –dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg.
  • Verify the key’s fingerprint: gpg –no-default-keyring –keyring /usr/share/keyrings/hashicorp-archive-keyring.gpg –fingerprint.
  • Add HashiCorp repo:
  • echo “deb [arch=$(dpkg –print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] $(lsb_release -cs) main” | sudo tee /etc/apt/sources.list.d/hashicorp.list
  • Update package list: sudo apt update.
  • Install Vault: sudo apt install vault.

To start Vault:

  • Run Vault server: vault server -dev -dev-listen-address=”″.

For configuring Terraform to read secrets from Vault:

  • To Enable AppRole: vault auth enable approle.
  • Enable secret engineTerraform
  • Create Secret Terraform
  • Create an AppRoleTerraform
  • After creating the AppRole in Vault, you must generate a pair consisting of a Role ID and a Secret ID. The Role ID acts as a static identifier, whereas the Secret ID serves as a dynamic credential.
  • To generate the Role ID, you can utilize the Vault CLI:

vault read auth/approle/role/my-approle/role-id

  • Make sure to retain the Role ID for integration into your Terraform configuration.
  • For generating the Secret ID, you can execute the following command:

vault write -f auth/approle/role/my-approle/secret-id

This command generates a new Secret ID for the specified AppRole. Ensure that the Secret ID is securely managed as it provides temporary access to resources associated with the AppRole.

Integrate the same with your configuration



Securing Terraform deployments is paramount to safeguarding your infrastructure and sensitive data. By implementing the best practices outlined above, you can mitigate risks, prevent unauthorized access, and maintain compliance with security standards. Remember, security is not a one-time task but an ongoing process that requires diligence and proactive measures. Stay vigilant, stay secure!

Become Certified DevOps Expert in 6 Months!!

  • Build Expertise in Top DevOps Tools
  • Get Placed in Top MNCs
Enroll now

About CloudThat

CloudThat is a leading provider of Cloud Training and Consulting services with a global presence in India, the USA, Asia, Europe, and Africa. Specializing in AWS, Microsoft Azure, GCP, VMware, Databricks, and more, the company serves mid-market and enterprise clients, offering comprehensive expertise in Cloud Migration, Data Platforms, DevOps, IoT, AI/ML, and more.

CloudThat is recognized as a top-tier partner with AWS and Microsoft, including the prestigious ‘Think Big’ partner award from AWS and the Microsoft Superstars FY 2023 award in Asia & India. Having trained 650k+ professionals in 500+ cloud certifications and completed 300+ consulting projects globally, CloudThat is an official AWS Advanced Consulting Partner, Microsoft Gold Partner, AWS Training PartnerAWS Migration PartnerAWS Data and Analytics PartnerAWS DevOps Competency PartnerAmazon QuickSight Service Delivery PartnerAmazon EKS Service Delivery PartnerAWS Microsoft Workload PartnersAmazon EC2 Service Delivery Partner, and many more.

To get started, go through our Consultancy page and Managed Services PackageCloudThat’s offerings.


1. What are the mechanisms for logging in to Terraform Vault UI?

ANS: – We have multiple login mechanisms like Github, root token, LDAP, OIDC, Active Directory etc.

2. Do we need to enable remote state locking for better security?

ANS: – Yes, we can configure a remote No-SQL database such as Dynamo DB for state locking to prevent any cross-user API faults and corrupting the state.

3. Should we save terraform.tfvars in a remote VCS?

ANS: – As a best practice, we should ignore adding terraform.tfvars in a remote VCS to avoid any type of sensitive information/variable being exposed to public or other teams

WRITTEN BY Akshay Mishra



    Click to Comment

Get The Most Out Of Us

Our support doesn't end here. We have monthly newsletters, study guides, practice questions, and more to assist you in upgrading your cloud career. Subscribe to get them all!