Read secrets from Terraform state

Terraform state often contains plaintext secrets. Find state in buckets, repos, or CI artifacts and grep it.

aws s3 cp s3://tf-state/prod/terraform.tfstate - | jq '.resources[].instances[].attributes | {password,secret_key,token,private_key}'

Also check backends and lock tables for access paths.

grep -rEn "backend "s3"|access_key|secret_key" *.tf
git log -p -- '*.tfstate'   # secrets in history even if removed

Pro note: a readable state backend is often as good as the credentials it provisioned. Check for public or over-permissioned state buckets, and for CI pipelines that print state or plan output to logs, which leaks the same values to anyone who can read builds.