Topic starter
08/07/2026 7:05 pm
TL;DR: Terraform and OpenTofu are functionally similar IaC tools, but neither is a secrets manager, so provisioning workflows still depend on external controls for rotation, certificates, and repository hygiene, according to Infisical. The real governance issue is that infrastructure automation can scale secret distribution faster than teams can govern secret lifecycle and exposure windows.
Editorial analysis by NHI Mgmt Group, based on content published by Infisical: “Terraform vs. OpenTofu: A Comprehensive Comparison”.
Key questions
Q: What breaks when Terraform or OpenTofu is treated as a secrets manager?
A: The organisation loses lifecycle control.
Q: Why do Terraform and OpenTofu still create secrets risk if the infrastructure model is declarative?
A: Declarative infrastructure defines what should exist, not how secrets are stored or protected.
Q: How can security teams tell whether IaC secret governance is working?
A: Look for short-lived credentials, centrally managed issuance, and a clean separation between provisioning code and secret storage.
Practitioner guidance
- Separate provisioning from credential governance Define IaC as an execution layer and assign secrets issuance, rotation, and revocation to a dedicated control path outside the pipeline.
- Inventory every machine credential used by IaC Map client secrets, tokens, certificates, and other non-human credentials across Terraform and OpenTofu workflows, including state, CI, and provider configuration.
- Move reusable credentials out of code repositories Replace embedded credentials in project files and environment scaffolding with centrally managed secret references and short-lived access wherever possible.
Bottom line: Terraform and OpenTofu create the same governance problem when teams confuse infrastructure provisioning with secrets lifecycle control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:29 pm
IaC choice is not the control plane. Terraform and OpenTofu sit on the execution side of provisioning, not on the governance side of credential lifecycle. That means the real control failure is assuming declarative infrastructure can also govern the secrets it consumes. The practitioner conclusion is simple: identity and secrets controls have to sit outside the IaC engine.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations standardise on Terraform or OpenTofu for secrets safety?
A: Not as the primary security decision. The more important choice is whether provisioning is wired to a governed secrets lifecycle. Organisations should prefer whichever IaC tool fits their platform model, then enforce separate control over issuance, rotation, revocation, and audit for the credentials it uses.
👉 Read our full editorial: Terraform and OpenTofu expose the same secrets governance gap