Terraform is bad at secrets. Not because it is poorly designed, but because secrets were never its job. Terraform manages infrastructure. Secrets belong to a secrets manager. The trouble starts when people treat Terraform like a secrets store, because Terraform will happily comply, and then it will store every secret it touches in plain text in your state file.

This post covers how to integrate HashiCorp Vault with Terraform properly: dynamic secrets versus static reads, AppRole authentication for CI/CD, sensitive outputs, and the uncomfortable truth about what still leaks even when you do everything right.

The core problem

Three ways secrets leak in a typical Terraform workflow:

State files. Terraform state stores every attribute of every resource in plain text. Database passwords, API keys, connection strings. If you read Article 1, you already encrypt your state bucket and restrict IAM access. That is necessary.…