IaC files have no hardcoded secrets

Infrastructure-as-Code files are source code: they are version-controlled, shared with teams, reviewed in pull requests, and often mirrored on GitHub. A Terraform file containing a hardcoded database password or a CloudFormation template with an embedded API key exposes those credentials to everyone with repository access and permanently records them in git history. CWE-798 applies directly to IaC secrets. OWASP A05 covers misconfigured infrastructure. SSDF PW.6 requires protecting code from unauthorized disclosure, which IaC with embedded secrets violates by definition.

Replace every hardcoded credential in IaC files with a variable marked sensitive = true or a direct secrets manager reference. Never pass secrets through Terraform output values unless they are also marked sensitive.

# BEFORE (wrong)
resource "aws_db_instance" "main" {
  password = "my-real-db-password"
}

# AFTER (correct) — variable with sensitive flag
variable "db_password" {
  type      = string
  sensitive = true
}
resource "aws_db_instance" "main" {
  password = var.db_password
}

# AFTER (correct) — secrets manager reference
data "aws_secretsmanager_secret_version" "db" {
  secret_id = "prod/db-password"
}
resource "aws_db_instance" "main" {
  password = jsondecode(data.aws_secretsmanager_secret_version.db.secret_string)["password"]
}

Pass variable values via TF_VAR_db_password environment variables in CI, never via -var flags that appear in shell history.