security

Enforce secure Terraform secrets handling and least-privilege network access.

Updated Jan 20, 2026

Search Tags:#terraform #rds #secrets-management #least-privilege #security-groups #iam-database-auth

Ready to run

npx skills add https://github.com/berTrindade/terraform-infrastructure-blueprints --skill security-bertrindade

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security
Source: https://github.com/berTrindade/terraform-infrastructure-blueprints/tree/main/skills/security
Command: npx skills add https://github.com/berTrindade/terraform-infrastructure-blueprints --skill security-bertrindade

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps enforce secure handling of Terraform secrets and implement least-privilege network access, preventing secret leakage in state and minimizing exposure surfaces.

Core Features & Use Cases

Secrets management: prevents secrets from being stored in Terraform state and supports ephemeral credentials or IAM-based authentication.
Least-privilege networking: enforces minimal ports, proper sources, and restricted access for Lambda, RDS, API Gateway, and ECS.
Real-world scenarios: validates RDS/Aurora passwords handling, Secrets Manager usage, and IAM DB authentication across cloud environments.

Quick Start

Review your Terraform modules to replace static passwords with ephemeral approaches and apply strict security group rules for your AWS resources.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent RDS passwords from appearing in Terraform state?▼

Enabling IAM database authentication for RDS allows your Terraform configuration to request ephemeral database credentials instead of managing static passwords. This prevents secret leakage in state and restricts access using IAM policies.

How do I enforce least-privilege security groups for Lambda and ECS in Terraform?▼

Enforcing least-privilege security groups for Lambda and ECS involves applying Terraform rules that restrict access to minimal ports and specific sources. This minimizes network exposure and isolates AWS resources properly.

Can I use IAM database authentication instead of Secrets Manager for Aurora with Terraform?▼

Yes, you can use IAM database authentication instead of Secrets Manager for Aurora with Terraform. IAM DB auth generates ephemeral tokens, which is an effective approach to avoid secrets in state and satisfy secure handling requirements.

What is the best way to manage ephemeral credentials for RDS in Terraform?▼

The best way to manage ephemeral credentials for RDS in Terraform is by implementing IAM database authentication or referencing Secrets Manager directly. This ensures secrets are not persisted in state and access remains temporary.

Why does my Terraform state still contain secrets after using Secrets Manager?▼

Terraform state may still contain secrets if resources are configured to store static passwords rather than referencing Secrets Manager dynamically or using IAM database authentication for ephemeral credentials. Review your module configurations to replace static assignments.