Many engineers assume Terraform becomes secure once the configuration syntax is correct.
The larger risk comes from the systems surrounding Terraform.
Terraform executes with cloud permissions. State files store infrastructure information. Git repositories preserve committed secrets. Third-party modules operate with the same privileges as the parent configuration.
A single weakness in any of these areas can affect the entire infrastructure deployment process.
This lesson examines six common Terraform security risks, including excessive IAM permissions, sensitive state data, hardcoded secrets, unreviewed changes, untrusted modules, and state tampering. The goal is to understand the mechanism behind each risk and the security controls that reduce exposure.
Security in Terraform begins with understanding what Terraform trusts and what happens when that trust is misplaced.