Security / Public reference

Secret assigned in a Terraform local

A Terraform local whose name looks like a password, secret, or token, and whose value is a non-empty literal.

What you need to supply

The locals block in the submitted Terraform. Interpolations are not evaluated.

If it reports a finding

High severity. The suggested next step is to pass the value from a secret store or a variable reference.

What this does not prove

password = var.password, an empty string, and environment = "prod" are not this finding. A secret in a comment is not this finding.

Local that this check is written to notice

locals {
  password = "hunter2"
}

All review checks. Reading this page does not submit your infrastructure.