skills.rest
berTrindade
berTrindadeCOMMUNITY
Explore all skills by this author →
GitHub

security

Enforce secure Terraform secrets handling and least-privilege network access.

Updated Jan 20, 2026
Search Tags:#terraform#rds#secrets-management#least-privilege#security-groups#iam-database-auth
One-click install
npx skills add https://github.com/berTrindade/terraform-infrastructure-blueprints --skill security-bertrindade
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security
Source: https://github.com/berTrindade/terraform-infrastructure-blueprints/tree/main/skills/security
Command: npx skills add https://github.com/berTrindade/terraform-infrastructure-blueprints --skill security-bertrindade

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps enforce secure handling of Terraform secrets and implement least-privilege network access, preventing secret leakage in state and minimizing exposure surfaces.

Core Features & Use Cases

  • Secrets management: prevents secrets from being stored in Terraform state and supports ephemeral credentials or IAM-based authentication.
  • Least-privilege networking: enforces minimal ports, proper sources, and restricted access for Lambda, RDS, API Gateway, and ECS.
  • Real-world scenarios: validates RDS/Aurora passwords handling, Secrets Manager usage, and IAM DB authentication across cloud environments.

Quick Start

Review your Terraform modules to replace static passwords with ephemeral approaches and apply strict security group rules for your AWS resources.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent RDS passwords from appearing in Terraform state?▼

Enabling IAM database authentication for RDS allows your Terraform configuration to request ephemeral database credentials instead of managing static passwords. This prevents secret leakage in state and restricts access using IAM policies.

How do I enforce least-privilege security groups for Lambda and ECS in Terraform?▼

Enforcing least-privilege security groups for Lambda and ECS involves applying Terraform rules that restrict access to minimal ports and specific sources. This minimizes network exposure and isolates AWS resources properly.

Can I use IAM database authentication instead of Secrets Manager for Aurora with Terraform?▼

Yes, you can use IAM database authentication instead of Secrets Manager for Aurora with Terraform. IAM DB auth generates ephemeral tokens, which is an effective approach to avoid secrets in state and satisfy secure handling requirements.

What is the best way to manage ephemeral credentials for RDS in Terraform?▼

The best way to manage ephemeral credentials for RDS in Terraform is by implementing IAM database authentication or referencing Secrets Manager directly. This ensures secrets are not persisted in state and access remains temporary.

Why does my Terraform state still contain secrets after using Secrets Manager?▼

Terraform state may still contain secrets if resources are configured to store static passwords rather than referencing Secrets Manager dynamically or using IAM database authentication for ephemeral credentials. Review your module configurations to replace static assignments.

Related Skills

Explore More Software Engineering Skills→
poc-micro-frontendspoc-micro-frontends

security

Enforce ephemeral passwords and IAM database authentication in Terraform configurations.

Official
Intermediate
benphamsebenphamse

terraform-module-library

Design reusable Terraform modules for AWS, Azure, and GCP with standardized structure.

Community
Advanced
colinmxscolinmxs

secrets-manager

Store and rotate credentials in AWS Secrets Manager with Lambda-based rotation.

Community
Advanced
infraspecdevinfraspecdev
3

terraform-security-audit

Audit Terraform AWS infrastructure for security vulnerabilities and policy flaws.

Official
Advanced