criticalIntermediateSymptom-first#sensitive#secrets#plan#output

Sensitive data visible in plan output

terraform plan output shows plaintext passwords or API keys

Likely source:security

Focused incident mode — strips away everything but this runbook.

Symptoms

  • terraform plan output shows plaintext passwords or API keys
  • Terraform outputs display sensitive values in CI logs
  • State file contains unencrypted secrets

Never log terraform plan to CI stdout without masking. Use terraform plan -json and filter sensitive values in the pipeline.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Plan output with secrets

    terraform plan 2>&1 | grep -iE 'password|secret|key|token'

  • Output declarations

    grep -n 'sensitive' outputs.tf

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • outputs.tf does not have sensitive = true
  • terraform plan shows the value in plaintext

Confirm before fixing

grep -n 'sensitive' outputs.tf
READ

Check for sensitive flag

Fix

sed -i '/output ".*"/a\ sensitive = true' outputs.tf
CHANGE

Mark outputs as sensitive

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
grep -n 'sensitive' outputs.tf
READ

Check which outputs are protected

2
terraform plan 2>&1 | grep -iE 'password|secret|key|token'
READ

Scan plan for leaked secrets

3
terraform output -json | jq 'to_entries[] | select(.value.sensitive==true) | .key'
READ

List sensitive outputs

4
terraform state pull | grep -iE 'password|secret|key|token'
READ

Scan state for plaintext secrets

Prevention

  • Mark ALL outputs containing secrets with sensitive = true.
  • Use terraform cloud or vault for secret storage instead of variables.
  • Enable state encryption at rest (S3 SSE, GCS CMEK).
  • Mask terraform output in CI logs using pipeline-specific secret detection.

Related runbooks

Same stack, same failure family — worth a skim.

State file gone — everything shows as newcritical

terraform plan shows everything will be created (no existing resources in state)

TerraformProduction2 causes
Open runbook
Corrupted local state — JSON parse error in state filecritical

Error: Error loading state: SyntaxError: JSON input

TerraformAdvanced2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.