Obsolete Module Management

Obsolete module management is the process of marking Terraform modules as no longer preferred, then removing them when they should not be used. It helps teams phase out risky or outdated infrastructure patterns without breaking governance. This reduces drift and makes module lifecycle decisions explicit.

Expanded Definition

Obsolete module management is the governance practice of retiring Terraform modules in a controlled way so teams stop selecting them for new deployments while existing estates can still be assessed, migrated, and eventually removed. In NHI and agentic infrastructure workflows, this is not just version hygiene. It is a lifecycle control for infrastructure logic that may embed secrets handling, identity bindings, network paths, or privileged execution patterns.

Definitions vary across vendors and platform teams on when a module becomes obsolete versus merely deprecated, so the practical boundary is usually operational risk, not age alone. A module should be treated as obsolete when it no longer meets policy, introduces unaccepted drift, or implements an identity or access pattern that conflicts with current controls. That aligns with lifecycle governance themes in the NIST Cybersecurity Framework 2.0 and with NHIMG guidance on lifecycle discipline in the NHI Lifecycle Management Guide. The most common misapplication is leaving an obsolete module available for new use after policy changes, which occurs when deprecation notices are not enforced in CI/CD or module registries.

Examples and Use Cases

Implementing obsolete module management rigorously often introduces short-term migration overhead, requiring organisations to weigh reduced security and drift risk against refactoring cost and delivery disruption.

• A platform team marks an older Terraform module obsolete after it hard-codes legacy secret paths, then blocks it from new pipelines while migrating consumers to a safer pattern described in Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs.
• An infrastructure registry retains a module only for maintenance of existing environments, while a change policy requires all new workloads to use the replacement module and reviewed identity bindings.
• A security team removes a module that provisions long-lived credentials in code after mapping the issue to the kinds of exposure patterns highlighted in Top 10 NHI Issues.
• A compliance group keeps an archived copy of a retired module for audit evidence, but strips it from the catalog so it cannot be selected in automation.
• A cloud engineering team replaces a widely used legacy module after a breach review shows it created an identity path that was too permissive for modern least-privilege expectations.

In practice, the retirement decision should be tied to policy enforcement and inventory accuracy, not informal team memory. That is why module deprecation and identity governance often move together.

Why It Matters in NHI Security

Obsolete modules are a hidden attack surface because they preserve older infrastructure patterns that often predate current NHI controls, secret rotation standards, or Zero Trust expectations. If an old module still exists in registries, templates, or shared libraries, teams may continue to deploy it unknowingly, reintroducing excessive privileges, embedded secrets, or brittle trust assumptions into new environments. NHIMG reports that 97% of NHIs carry excessive privileges, which makes stale module reuse especially dangerous when the module provisions identities or access paths by default.

This is also a governance issue. Retiring modules without a clean process creates drift between policy and practice, and that drift often survives long enough to become an audit finding or incident root cause. The Ultimate Guide to NHIs — Regulatory and Audit Perspectives ties lifecycle discipline to evidence and accountability, while the NIST Cybersecurity Framework 2.0 reinforces the need to manage assets and access consistently across their lifecycle. Organisations typically encounter the consequences only after a legacy deployment or audit failure reveals that an obsolete module was still being used, at which point obsolete module management becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Non-Human Identity Access Management
• What is NHI posture management?
• How does NHI lifecycle management differ from human identity lifecycle management?
• What is the most common mistake organisations make with NHI credential management?