IaC Secrets in Terraform and Azure CSCfg

Detects secrets embedded in Infrastructure as Code files including Terraform/HCL variable assignments and Azure Cloud Service configuration (.cscfg) XML settings. Mirrors Snaffler rule KeepInfraAsCodeByExtension.

Type

regex

Engine

boost_regex

Confidence

high

Confidence justification

High confidence: the combination of secret-bearing key names and non-empty quoted values in IaC contexts is highly specific to credential assignments. Non-secret HCL assignments (region, version, count) do not match because their key names are not in the keyword list.

Jurisdictions

global

Regulations

Criminal Code Act 1995 (Cth)

Frameworks

CIS Controls, ISO 27001, NIST CSF

Data categories

credentials

Scope

specific

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)(?:password|secret|access_key|api_key|token)\s*=\s*"[^"]{6,256}"

Corroborative evidence keywords

terraform, provider, variable, <ServiceConfiguration, <Role

Proximity: 300 characters

Should match

• db_password = "Sup3rS3cret!" — Exact 65 probe - secret-bearing assignment without independent IaC document context
• resource "aws_db_instance" "orders" { identifier = "orders-prod" password = "N7v!m2P9x4R8s6T3" } — Exact 75 probe - populated secret assignment inside a normal HCL resource block
• provider "azurerm" { subscription_id = "c8f12a4e-96b1-4eb0-b92a-f1025c913bd7" client_id = "0e33e4f8-e6db-4a75-93cc-265d9b68c211" client_secret = "Q7v!m2P9x4R8s6T3" tenant_id = "218a4f19-4e9c-4c58-8364-a72b11eca134" features {} } — Exact 85 probe - real provider block plus populated secret assignment
• <ServiceConfiguration><Setting name="StorageKey" value="abc123def456ghi789jkl012" /></ServiceConfiguration> — Exact 75 probe - Azure cscfg assignment with service-configuration structure
• <ServiceConfiguration><Role name="Web"><Setting name="ApiToken" value="abc123def456ghi789jkl012" /></Role></ServiceConfiguration> — Exact 85 probe - Azure cscfg assignment with an independent role binding

Should not match

• region = "ap-southeast-2" — Non-secret HCL assignment, key name not in keyword list
• <Setting name="MaxRetries" value="3" /> — Non-secret cscfg setting with value under 6 chars
• token_type = "Bearer" — Generic non-secret token metadata remains below enforcement tiers
• api_key = "********" — Masked assignment is excluded from all tiers
• provider "aws" { access_key = "placeholder" region = "ap-southeast-2" } — Provider block with a common placeholder value is excluded
• provider "aws" { secret = "${var.aws_secret}" region = "ap-southeast-2" } — Provider block with variable interpolation rather than an embedded secret is excluded
• Documentation example: provider "aws" { api_key = "n4Y8p2V7c6D3r9T5" region = "ap-southeast-2" } — Documentation example with otherwise high-tier provider structure is excluded

Known false positives

• Terraform example or tutorial files showing variable assignment syntax with illustrative but non-sensitive values using the target key names. Mitigation: Require proximity to IaC-specific keywords (terraform, provider, ServiceConfiguration) to confirm IaC file context. Template exclusion catches example/placeholder markers.
• Application configuration files that use password or token as part of a larger non-credential key name such as password_policy or token_expiry. Mitigation: The regex anchors on the full key name followed immediately by = and a quoted value, limiting spurious matches from compound key names.

Collections

• Snaffler Parity — Credential & Secret Files