Hardcoded HashiCorp Terraform API token in source codeSCT-1017

Leaking a HashiCorp Terraform API token in source code can cause severe security issues as it can give unauthorized access to critical infrastructure resources. Unauthorized access to infrastructure resources can lead to system outages, data breaches, and financial loss.

If an API token has been leaked, you can revoke the token to mitigate the vulnerability.

It is recommended to use environment variables to store the API token. This ensures that the token is not hardcoded in the source code and is kept separate from the codebase. Using environment variables also makes it easier to manage the API token as it can be updated without modifying the source code. Additionally, it is recommended that access to the API token is restricted to only those who need it, by using Terraform Cloud's Team and User Permissions feature.

Bad practice

provider "azurerm" {
  subscription_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  client_id       = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  client_secret   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  tenant_id       = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}

Recommended

provider "azurerm" {
  subscription_id = var.subscription_id
  client_id       = var.client_id
  client_secret   = var.client_secret
  tenant_id       = var.tenant_id
}

It is recommended to store the API token in an encrypted .tfvars file:

subscription_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
client_id       = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
client_secret   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
tenant_id       = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

And load it with the terraform command:

terraform apply -var-file="secrets.tfvars"

References

• HashiCorp Terraform: API Tokens