My previous team argued with me when i said to avoid using terraform with vault with our state in S3.
I eventually got my way after 18 months and found out it was really bad - hard coded s3 access keys were floating around that could read any bucket and they had used terraform with vault and that had pulled all sorts of root level creds into the plain text state files.
Lots of other ways to control this risk but I removed vault from TF.
I eventually got my way after 18 months and found out it was really bad - hard coded s3 access keys were floating around that could read any bucket and they had used terraform with vault and that had pulled all sorts of root level creds into the plain text state files.
Lots of other ways to control this risk but I removed vault from TF.