Terraform state exposure
Terraform state exposure is the disclosure of the state file that infrastructure as code tooling maintains to track deployed resources. The file records resource attributes as they were applied, which means values that were secret in the configuration are stored in it as readable text.
The mechanism is a consequence of the design rather than a defect. To decide what has changed, the tool needs to know what it created, so it writes the attributes back. A generated database password, an access key created for an application, a private key, a connection string: each is stored as the value that was applied. Marking a variable as sensitive suppresses it from console output and does not remove it from the state.
The finding is therefore about where the file lives and who can read it. Committed to a repository it becomes a credential store with the access control of source code. In an object storage bucket it inherits whatever that bucket allows, and buckets created for pipeline plumbing are routinely created without encryption, without versioning and with permissions granted to a broad group. A single state file often yields credentials to more of the estate than any host would.
What to do is unambiguous: remote state with encryption, strict and separate access control, versioning and locking; secrets generated and read from a managed store at deployment time rather than created by the pipeline; and the file treated as a production secret in its own right. Reviewing it alongside the wider infrastructure as code security and secrets management posture is part of the cloud testing where the pipeline’s own storage is in scope.