In terraform, when we create a resourcekey for eg ibm_resource_key, all the credentials created are stored in plain text in state file. Question is how to hide/mask the credential section/ secret sections in state file.

Options are to store the state file itself in some safe place like S3 , vault etc, but is there a way to hide the info in state file itself?

3 Answers 3


The tfstate file can be thought of as your "executable". So no, you cannot hide/remove sensitive values from it.

What you can do, however, is to store it safely. Terraform offers tutorials on how to configure your backend to store the tfstate (because this file must never make it to your Git repository). Usually it consists of an S3 bucket (to store the contents) and a DynamoDB table (for version management).


An alternative strategy is having your passwords outside of terraform's management and use a data query to collect which ever passwords are required. This way, if you need to password rotations, the terraform won't reconfigure the resource with the former password

Good options are using AWS's Secrets Manager, or HashiCorp Vault


If you are storing credentials in your terraform state file, you can use the terraform state show command to mask the sensitive fields:

terraform state show -no-color module.web | sed -e 's/sensitive_string./sensitive_string = "**"/'

This will replace the sensitive string field with asterisks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.