Your Terraform state file is a plaintext secrets store. Mine was too. (opens in new tab)

Here's a fact that's easy to forget until it bites you: a Terraform state file stores resource attributes in plaintext — and that includes secrets. RDS master passwords, IAM access keys baked into user data, API tokens passed as variables. They're all just sitting there in terraform.tfstate as readable JSON. That's fine-ish when the file lives in an encrypted S3 backend that three people can touch. It is not fine the moment your tooling starts reading, persisting, or rendering those attribute...