A duplicate Terraform resource definition occurs when the same infrastructure object is declared or imported in more than one file, module, or code path. This creates competing desired states, which can lead to drift, unstable plans, and failed applies when Terraform cannot determine a single authoritative owner.
Expanded Definition
Duplicate Terraform resource definition is an infrastructure-as-code condition where the same resource address, or the same real-world object, is declared more than once across files, modules, or import paths. In practice, Terraform expects a single authoritative owner for each managed object. When that ownership is split, plans can become unstable, resource replacement may be proposed unexpectedly, and apply operations can fail because Terraform cannot reconcile competing desired states. The issue is not limited to direct duplication in one file. It also appears when a module is instantiated twice with overlapping resource names, when imported infrastructure is later re-declared elsewhere, or when refactoring leaves a stale definition behind. In NHI-adjacent environments, this matters because service accounts, API keys, and secret-bearing infrastructure often sit inside automated delivery pipelines that assume deterministic state. Terraform’s own workflow is designed around a single source of truth, which is why the guidance in NIST Cybersecurity Framework 2.0 on disciplined configuration management is relevant here. The most common misapplication is treating duplicate definitions as a harmless copy-paste issue, which occurs when teams split ownership of the same resource across modules during fast-moving refactors.
Examples and Use Cases
Implementing Terraform rigorously often introduces stricter module boundaries and review overhead, requiring organisations to weigh deployment speed against state correctness and change control.
- A platform team defines an AWS IAM role in a shared module, while an application team unknowingly recreates the same role in a service-specific root module. The result is competing plans and ambiguous ownership.
- An imported secret backend resource is later reintroduced in code after a migration. Terraform sees two declarations for one object, causing drift between the imported state and the new configuration.
- A refactor splits one monolithic configuration into multiple files, but an old resource block is left behind. The duplicate is subtle because it may only surface when the plan is refreshed.
- A CI/CD pipeline renders the same module twice with overlapping naming logic. This can be especially dangerous for identity infrastructure discussed in the Ultimate Guide to NHIs — What are Non-Human Identities, where duplicated ownership can expose privileged service accounts.
- A security engineer investigates why an infrastructure change keeps failing and traces it to a stale definition that was never removed after modularisation. Similar hard-coded trust failures have been analysed in Gladinet Hard-Coded Keys RCE Exploitation, where hidden assumptions in code create security exposure.
Why It Matters in NHI Security
Duplicate resource definitions are not just a build-time annoyance. In NHI security, they can create inconsistent control of secrets managers, key rotation workflows, IAM bindings, and pipeline credentials. When two code paths believe they own the same resource, the organisation often loses confidence in whether a service account, token, or certificate is actually governed, rotated, or revoked as intended. That matters because NHIs already create disproportionate risk when they are unmanaged. NHI Mgmt Group reports that NHIs outnumber human identities by 25x to 50x in modern enterprises, and 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools. Duplicate definitions can magnify that exposure by making owners assume a control exists when the actual deployment path is ambiguous. In governance terms, the fix is not only technical deduplication but also clear resource ownership, code review discipline, and state hygiene aligned to NIST Cybersecurity Framework 2.0. Organisations typically encounter the full impact only after an apply failure or an unexpected replacement, at which point duplicate Terraform resource definition becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Duplicate ownership of NHI infrastructure drives insecure lifecycle and configuration drift. |
| NIST CSF 2.0 | PR.DS-1 | Configuration integrity and asset control are directly impacted by duplicate Terraform ownership. |
| NIST Zero Trust (SP 800-207) | SC-4 | Zero trust requires controlled, unambiguous management of identity infrastructure and dependencies. |
| NIST SP 800-63 | Credential lifecycle governance depends on avoiding split ownership of identity resources. | |
| OWASP Agentic AI Top 10 | AI-05 | Agentic delivery pipelines can duplicate tool and secret resources across workflows. |
Ensure identity-related infrastructure has one lifecycle owner so provisioning and revocation stay consistent.
Related resources from NHI Mgmt Group
- Should organisations block all non-module Terraform resource creation?
- How should security teams handle Terraform provider upgrades that can change resource behavior and break existing CI/CD pipelines?
- What is the difference between a classic portal resource and a newer portal resource in a Terraform provider?
- What is the difference between identity-based and resource-based policies?
