Terraform misconfiguration

What it means

Terraform is a widely used tool for describing cloud infrastructure in code. A Terraform misconfiguration is an insecure setting written into those files: a public storage bucket, a firewall rule open to the whole internet, a database without encryption, a role with unlimited permissions.

Terraform did what it was told. The weakness was in the instruction. Because the file is applied automatically, the insecure setting is created exactly as written, every time, in every environment that uses it.

Why it matters

A manual mistake affects one resource. A mistake in a shared module can affect dozens of services at once, including ones created long after the original author left. Fixing it means changing the code and applying it again, not just editing the resource.

There is another risk in the state. Terraform's state file can hold sensitive values, such as database passwords, in plain text. HashiCorp's documentation says to treat state as sensitive and protect it. A readable state bucket becomes a source of credentials.

How it shows up

You meet it in modules copied from tutorials, defaults that favour convenience, rules opened for testing and left, and variables that carry secrets. Pipelines that apply the code often run with powerful credentials, so overly broad permissions there matter doubly.

Scan the files before applying with a policy or static analysis tool, review plans in pull requests, store state in an encrypted, access-controlled backend and never put secrets in the code. Compare running resources with the code to catch drift. Handle it like any cloud misconfiguration.