What is the most secure place to store secrets for connecting to a Terraform remote backend?

What is the most secure place to store secrets for connecting to a Terraform remote backend?

• A. Defined in Environment variables
• B. Inside the backend block within the Terraform configuration
• C. Defined in a connection configuration outside of Terraform
• D. None of above

Answer: (C)

Storing secrets outside of Terraform itself, in a dedicated connection configuration or secret store, is the safest approach for authenticating to a remote backend. Keeping credentials in a separate, external system (like Vault, AWS Secrets Manager, or a CI secret store) allows you to rotate, audit, and restrict access without exposing them in your Terraform code or in the backend block. Embedding secrets in the backend configuration ties them to the codebase, which can be checked into version control, shared in logs, or exposed in process listings. Environment variables, while common, can still leak through logs or process listings and are harder to rotate reliably across environments. By using a connection configuration outside of Terraform, you centralize secret management and minimize the risk of credential leakage while still enabling Terraform to access the remote backend securely.

Storing secrets outside of Terraform itself, in a dedicated connection configuration or secret store, is the safest approach for authenticating to a remote backend. Keeping credentials in a separate, external system (like Vault, AWS Secrets Manager, or a CI secret store) allows you to rotate, audit, and restrict access without exposing them in your Terraform code or in the backend block. Embedding secrets in the backend configuration ties them to the codebase, which can be checked into version control, shared in logs, or exposed in process listings. Environment variables, while common, can still leak through logs or process listings and are harder to rotate reliably across environments. By using a connection configuration outside of Terraform, you centralize secret management and minimize the risk of credential leakage while still enabling Terraform to access the remote backend securely.