Security / Public reference

Referenced secret

A same-file secret-like variable or parameter default used through a reference.

What you need to supply

The variable or parameter Default and the resource, module argument, or property that references it, in the same file.

If it reports a finding

High severity. The suggested next step is to pass the value from a secret store and leave the default empty.

What this does not prove

An unknown name stays quiet. The same secret value is reported once. A secret that appears only in a comment is not this finding.

Reference that this check is written to notice

variable "password" {
  default = "hunter2"
}
resource "aws_db_instance" "db" {
  password = var.password
}

All review checks. Reading this page does not submit your infrastructure.