Terraform security is the practice of making sure Terraform code, state and workflows don’t create insecure infrastructure or expose credentials. It covers misconfigured resources, secrets in code or state, unpinned providers and modules, and who can run terraform apply against production.
Terraform security best practices
- Pin provider and module versions and review upgrades.
- Store state remotely with encryption, locking and restricted access.
- Never hardcode credentials; use environment variables or a secrets manager.
- Restrict security group rules, and avoid 0.0.0.0/0 on admin ports.
- Enforce encryption, logging and tagging with policy as code.
- Check every plan in CI/CD before apply, and require review for production.
Steampunk Spotter verifies Terraform plans before execution, checking provider compatibility, breaking changes, supply chain risk and custom policies.
