<p>The tfstate file can be thought of as your &quot;executable&quot;. So no, you cannot hide/remove sensitive values from it.</p>
<p>What you can do, however, is to store it safely. Terraform offers <a href="https://developer.hashicorp.com/terraform/language/settings/backends/s3" rel="nofollow noreferrer">tutorials</a> on how to configure your backend to store the tfstate (because this file must never make it to your Git repository). Usually it consists of an S3 bucket  (to store the contents) and a DynamoDB table (for version management).</p>

CC BY-SA 4.0
2022-10-26T11:38:36.980Z
2022-10-26T11:38:36.980Z
avazula
<p>An alternative strategy is having your passwords outside of terraform's management and use a data query to collect which ever passwords are required. This way, if you need to password rotations, the terraform won't reconfigure the resource with the former password</p>
<p>Good options are using AWS's Secrets Manager, or HashiCorp Vault</p>

CC BY-SA 4.0
2022-10-26T18:35:24.123Z
2022-10-26T18:35:24.123Z
Ken
<p>If you are storing credentials in your terraform state file, you can use the terraform state show command to mask the sensitive fields:</p>
<p>terraform state show -no-color module.web | sed -e 's/sensitive_string.<em>/sensitive_string = &quot;</em>**&quot;/'</p>
<p>This will replace the sensitive string field with asterisks.</p>

CC BY-SA 4.0
2022-10-07T12:07:57.487Z
2022-10-07T12:07:57.487Z
Rahul Sherkar
<p>In terraform, when we create a resourcekey for eg ibm_resource_key, all the credentials created are stored in plain text in state file.
Question is how to hide/mask the credential section/ secret sections in state file.</p>
<p>Options are to store the state file itself in some safe place like S3 , vault etc, but is there a way to hide the info in state file itself?</p>

<terraform><ibm-cloud>
How to hide/mask credentials stored at terraform state file
Adya
# How to hide/mask credentials stored at terraform state file

(Asked by: username_0 on 2022-10-07)

In terraform, when we create a resourcekey for eg ibm\_resource\_key, all the credentials created are stored in plain text in state file.
Question is how to hide/mask the credential section/ secret sections in state file.

Options are to store the state file itself in some safe place like S3 , vault etc, but is there a way to hide the info in state file itself?

**Tags:** terraform, ibm-cloud


---

## 3 answers

### Answer by username_1 on 2022-10-26. Score: 1

The tfstate file can be thought of as your "executable". So no, you cannot hide/remove sensitive values from it.

What you can do, however, is to store it safely. Terraform offers [tutorials](https://developer.hashicorp.com/terraform/language/settings/backends/s3) on how to configure your backend to store the tfstate (because this file must never make it to your Git repository). Usually it consists of an S3 bucket (to store the contents) and a DynamoDB table (for version management).


---

### Answer by username_2 on 2022-10-26. Score: 0

An alternative strategy is having your passwords outside of terraform's management and use a data query to collect which ever passwords are required. This way, if you need to password rotations, the terraform won't reconfigure the resource with the former password

Good options are using AWS's Secrets Manager, or HashiCorp Vault


---

### Answer by username_3 on 2022-10-07. Score: -1

If you are storing credentials in your terraform state file, you can use the terraform state show command to mask the sensitive fields:

terraform state show -no-color module.web | sed -e 's/sensitive\_string.*/sensitive\_string = "*\*\*"/'

This will replace the sensitive string field with asterisks.


---

