Infrastructure drift control
Protect infrastructure state as operational data
State and plan artefacts can reveal sensitive values and resource relationships. Redacting terminal output does not necessarily remove those values from stored files.
In this article
Identify where artefacts are stored
List local state, remote state, saved plans, pipeline artefacts and diagnostic exports. Determine who can read or modify each location.
Terraform documentation distinguishes sensitive display handling from whether values exist in state or plan data. Review the actual mechanism used by the current configuration rather than assuming a sensitive label removes stored content.
Keep these artefacts out of public repositories and broad file-sharing locations.
Separate reading from changing infrastructure
A drift detector may need to inspect configuration without applying changes. Give its identity the scope required for that task and protect the reports it produces.
A deployment identity needs a different authority path. Avoid exposing its credentials to every user who can view a plan or investigate a difference.
Review state modification access carefully. Changing the management record can affect later infrastructure operations even without an immediate cloud API mutation.
Inspect alert and debug output
Use synthetic sensitive values in a safe test and examine pipeline logs, notifications and downloadable artefacts. Check failure output as well as normal summaries.
A redacted console view may coexist with a saved machine-readable plan containing more detail. Apply access and retention controls to the artefact itself.
Include resource relationships that may be sensitive even without passwords, such as internal endpoints and account structure.
Maintain recovery and auditability
Protect state backups and the supported recovery procedure. The team needs a way to recover from accidental state damage without granting uncontrolled write access to everyone.
Record who changed infrastructure definitions, approved the plan and executed it. Keep the evidence useful without duplicating secrets.
Review temporary downloads created during incidents and remove them according to policy. The access model should cover the entire infrastructure workflow, including the files operators use to understand and repair it.
Primary sources
HashiCorp: managing sensitive dataReferences checked 11 September 2026.