[Understand Infrastructure as Code (IaC) Concepts] It is best practice to store secret data in the same version control repository as your Terraform…

Storing secret data, such as API keys, passwords, or certificates, directly within a version control repository alongside Terraform configuration is a significant security anti-pattern, not a best practice. Committing secrets to version control exposes them to anyone with access to the repository's history, even if the secrets are later removed from the current version. The recommended best practice is to manage secrets externally using a dedicated secrets management tool (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) and inject them into the Terraform configuration at runtime. Alternatively, secrets can be passed as environment variables or through variable definition files (.tfvars) that are explicitly excluded from version control (e.g., via .gitignore).

The statement is presented as a "best practice," which is fundamentally incorrect. Security best practices for Infrastructure as Code (IaC) universally advise separating secrets from code. Following the practice suggested in the question would lead to a high risk of credential leakage and system compromise.

1. HashiCorp Terraform Documentation

"Protecting Sensitive Input Variables": This official guide explicitly warns against the practice. It states

"Do not save files containing sensitive values to your version control system. Your organization may have other policies about how to handle sensitive values. In general

we recommend using one of the following methods to provide sensitive variable values..." The document then lists secure methods like using environment variables or a secrets management tool.

Source: HashiCorp

Terraform Documentation

"Variables - Protecting Sensitive Input Variables".

2. HashiCorp Terraform Documentation

"Sensitive Data in State": While this page focuses on state files

it reinforces the core principle of handling sensitive data with care. It introduces the sensitive attribute for outputs

which prevents Terraform from showing their values in CLI output

demonstrating the platform's built-in awareness of the need to protect secrets. The underlying principle is that sensitive data should not be casually exposed

which is what happens when it is committed to version control.

Source: HashiCorp

Terraform Documentation

"Security - Sensitive Data in State".

3. HashiCorp Vault Documentation

"Secrets Management": The documentation for HashiCorp's dedicated secrets management tool

Vault

describes the problem that it is designed to solve. It states

"The first challenge of secrets management is the elimination of secret sprawl. Secret sprawl is the result of hardcoded credentials in source code

configuration files

and CI/CD systems..." This directly identifies storing secrets in configuration files (which are in version control) as a problem to be solved

not a best practice.

Source: HashiCorp

Vault Documentation

"Introduction to Vault - Secrets Management".