Security / Public reference

Secret assigned in a Terraform variable

A tfvars assignment or Terraform variable default that gives a non-empty literal to a secret-like name.

What you need to supply

The tfvars file or the Terraform variable block. References are not evaluated.

If it reports a finding

High severity. The suggested next step is to pass the value from a secret store or leave the default empty.

What this does not prove

A reference such as var.password, an empty string, and environment = "prod" are not this finding. A secret in a comment is not this finding.

Assignment that this check is written to notice

password = "hunter2"

All review checks. Reading this page does not submit your infrastructure.