Terraform Cloud encryption, keys & secrets security checks
Encryption at rest and in transit, key rotation, and the API keys, tokens and credentials that outlive the people who created them.
On Terraform Cloud, Black Cat runs 3 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Terraform Cloud connector needs.
Checks (3)
severity: critical Variable Not Marked Sensitive fix difficulty: easy #
Mark variables with sensitive names as sensitive to prevent plaintext exposure in logs and UI
- Log in to Terraform Cloud and navigate to the workspace or variable set containing the variable
- Locate the variable flagged by its name pattern
- Delete the variable and recreate it with the "Sensitive" checkbox enabled
- Note: sensitive variables cannot be read back through the API after creation
- Verify the run logs no longer display the variable value in plaintext
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.ii HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.e.3 DORA (SaaS Security) DORA-9.8
severity: medium Variable Set Global Scope fix difficulty: medium #
Restrict the variable set scope to specific workspaces rather than the entire organization
- Log in to Terraform Cloud and navigate to Organization Settings > Variable Sets
- Select the globally-scoped variable set
- Change "Scope" from "Apply to all workspaces" to "Apply to specific workspaces"
- Add only the workspaces that require these variables
- Save the change and verify workspaces still have the required variables available
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.ii HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.e.3 DORA (SaaS Security) DORA-9.8
severity: critical Variable Plaintext Credentials fix difficulty: medium #
Immediately rotate the exposed credential and re-create the variable as sensitive
- Rotate the exposed credential immediately in the target service (AWS, GitHub, OpenAI, etc.)
- Log in to Terraform Cloud and delete the plaintext variable
- Recreate the variable with the new credential value and enable the "Sensitive" checkbox
- Audit access logs of the variable's workspace to check for unauthorized use of the exposed credential
- Review other variables in the same workspace for similar exposure
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.ii HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.e.3 DORA (SaaS Security) DORA-9.8