Encrypting secrets in Hashicorp Terraform

Written by

Yandex Cloud

Updated at March 3, 2025

Recommendations for safely storing secret data
See also

To encrypt data:

In the configuration file, describe the parameters of the yandex_kms_secret_ciphertext resource and specify the KMS key in the key_id field:
```
resource "yandex_kms_secret_ciphertext" "password" {
  key_id      = "<key_ID>"
  aad_context = "additional authenticated data"
  plaintext   = "strong password"
}
```
Where:
- key_id: KMS key ID.
- aad_context: (AAD context).
- plaintext: String to be encrypted.
Warning

yandex_kms_secret_ciphertext enables you to hide secrets when deploying an infrastructure. However, in general, it is not safe to openly specify the plaintext and aad_context in the configuration file. Secrets can be read from configuration files or execution logs and can end up in the Terraform state.

For more information about resource parameters in Terraform, see the provider documentation.
Check the configuration using this command:
```
terraform validate
```
If the configuration is correct, you will get this message:
```
Success! The configuration is valid.
```
Run this command:
```
terraform plan
```
The terminal will display a list of resources with parameters. No changes will be made at this step. If the configuration contains any errors, Terraform will point them out.
Apply the configuration changes:
```
terraform apply
```
Confirm the changes: type yes into the terminal and press Enter.

The ciphertext can then be accessed via the ciphertext variable, and the encrypted data via the plaintext variable.

To check, you can add the following code with the decrypted_pass output variable to the configuration file.

Alert

This is not safe and can only be used for testing.
```
output "decrypted_pass" {
  sensitive = true
  value     = yandex_kms_secret_ciphertext.password.plaintext
}
```
After updating the configuration, you can check the encrypted data using the command:
```
terraform output decrypted_pass
```
Result:
```
"strong password"
```

Recommendations for safely storing secret data

Do not explicitly specify the secret values in the configuration file. Read them from a storage with restricted access (e.g., a secret storage).
Consider storing the Terraform state remotely.

Encrypting secrets in Hashicorp Terraform

Recommendations for safely storing secret dataRecommendations for safely storing secret data

See alsoSee also

Was the article helpful?

Recommendations for safely storing secret data

See also