Why Terraform state can expose secrets
Terraform stores resource attributes and output values to track infrastructure. The sensitive flag controls ordinary display; it does not remove the value from state. Passwords, connection strings, keys, rendered configuration and opaque provider-private data can therefore travel with a snapshot. Audit a copy before sending it for support and protect the operational original with access controls.
How the local sanitizer works
The tool reads sensitive output flags and resource sensitive_attributes paths, inventories module addresses, instances and provider references, and scans all JSON values, including extension fields. Key-name checks and bounded patterns identify likely passwords, tokens, PEM private keys, JWT-shaped values, known credential prefixes, URL credentials, secret query parameters and secret-named values in embedded JSON. These are heuristic findings, not authenticated or provider-specific conclusions.
Choose broader replacement of outputs, attributes or common identifiers, or add exact JSON pointers for fields the scanner cannot recognize. Exact string-copy detection follows selected values, including nested values. It does not find every substring, encoded, compressed or encrypted copy. Unknown sensitive path forms trigger whole-attribute replacement with a warning.
Supported format and export boundaries
Supports unencrypted version-4 snapshot JSON such as a local .tfstate or the output of terraform state pull. It refuses legacy versions, terraform show -json, binary plans, encrypted envelopes, duplicate JSON keys and inputs over its limits. It preserves untouched source text and numeric literals. Set-valued sensitivity indexes and legacy flat-attribute sensitivity cannot be resolved authoritatively; conservative replacements and warnings explain them.
Download the full redacted JSON, a value-free JSON or formula-safe CSV audit, and a printable HTML report suitable for Print to PDF. The preview and on-page tables are bounded; exports contain all findings and replacement proof. Reports still contain structural names and pointers. No backend, provider, cloud account or Terraform executable is contacted.
Review before sharing
This is an analysis aid. Secrets can occur in map keys, resource names, scripts, arbitrary identifiers and unrecognized blobs. Review the entire exported copy in an approved local editor and use your organization’s secret scanning and data-handling process before distribution. Keep the original secure. If credentials were already exposed, rotate them with the authoritative provider. Redacted JSON is a disposable review artifact; its types and metadata may be inconsistent, so never use it as Terraform state.
Frequently asked questions
Does Terraform sensitive encrypt state?
No. Sensitive marking hides values in normal CLI output; persisted state can still contain them. Secure the original state and review any copy before sharing.
Is my Terraform state uploaded?
No. This tool parses and redacts the state in a local browser worker. File contents are not sent to analytics.
Can I restore or push the redacted copy?
No. The export is a review and sharing artifact, not operational state. Replacing values can violate provider schemas, output types and Terraform invariants. Never push or restore it.
Which state format is supported?
Unencrypted version-4 Terraform snapshot JSON, typically a .tfstate file or terraform state pull output. Legacy state, plan files, terraform show -json and encrypted state envelopes are unsupported.
Authoritative references
HashiCorp explains sensitive data management and Terraform state. The bounded snapshot reader follows the version-4 state and typed path representation; it does not implement Terraform or provider schema validation.