IaC Security Cheat Sheet [2026]: Terraform & OpenTofu

Shift-left security for infrastructure as code is less about buying another scanner and more about tightening the default path every engineer already uses. For Terraform and OpenTofu, that means validating before remote access, pinning providers with a lock file, reviewing plans as sensitive artifacts, and making state storage boringly secure. The commands and patterns below were verified against official HashiCorp and OpenTofu docs on May 20, 2026, and optimized for breadth over depth.

Terraform vs OpenTofu

What actually changes for security

• Validation behavior: both tools validate configuration before plan and apply, and both support standalone validate for early feedback.
• Supply-chain controls: both tools use .terraform.lock.hcl to record provider selections and checksums.
• State exposure risk: both tools can surface sensitive values through artifacts and automation if you treat state or JSON output casually.
• Encryption posture: OpenTofu ships native state and plan encryption; Terraform expects you to get encryption from the backend or HCP platform layer.

Daily Security Loop

Live Command Filter

Keyboard Shortcuts

Commands Grouped by Purpose

terraform fmt -check
terraform init -backend=false
terraform validate -json

tofu fmt -check
tofu init -backend=false
tofu validate -json

terraform plan -out=tfplan -detailed-exitcode
terraform show -json tfplan > plan.json

tofu plan -out=tfplan -detailed-exitcode
tofu show -json -plan=tfplan > plan.json

terraform providers mirror -platform=linux_amd64 ./mirror

tofu providers mirror -platform=linux_amd64 ./mirror

terraform plan -refresh-only
terraform force-unlock LOCK_ID

tofu plan -refresh-only
tofu force-unlock LOCK_ID

terraform test -filter=tests/validations.tftest.hcl

tofu test -filter=tests/validations.tftest.hcl

Secure Config Patterns

Pin providers and make upgrades reviewable

• Declare provider sources and version constraints in code.
• Commit .terraform.lock.hcl so checksum and version changes show up in PRs.
• Do not treat provider upgrades as an incidental side effect of init.

terraform {
  required_version = ">= 1.6.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

Keep secrets out of the happy path

• Mark values as sensitive for safer UI behavior, but do not mistake redaction for storage security.
• Prefer remote state with encryption and strong access control over local plaintext state on laptops.
• Pass dynamic backend settings through -backend-config rather than hard-coding environment-specific values everywhere.

variable "db_password" {
  type      = string
  sensitive = true
}

terraform init -backend-config=prod.hcl

Use CLI configuration to constrain provider installs

• Filesystem mirrors reduce surprise downloads and help air-gapped or tightly controlled runners.
• Shared plugin caches can reduce repeated downloads, but they are not the same thing as a policy boundary.

plugin_cache_dir = "$HOME/.terraform.d/plugin-cache"

provider_installation {
  filesystem_mirror {
    path    = "/usr/share/terraform/providers"
    include = ["hashicorp/*"]
  }

  direct {
    exclude = ["hashicorp/*"]
  }
}

OpenTofu-only encryption option

• If native encryption at rest for state and saved plans is a platform requirement, OpenTofu gives you a built-in path instead of pushing that entirely into backend selection.
• That reduces one class of accidental exposure, but it does not replace access control, key rotation, or artifact hygiene.

Advanced Automation

Encode assumptions with preconditions, postconditions, and checks

• Use precondition for assumptions you need before a resource is created.
• Use postcondition for guarantees the resulting object must satisfy.
• Use check blocks for non-blocking validation that still surfaces dangerous drift or bad outcomes.

resource "aws_instance" "app" {
  ami           = data.aws_ami.app.id
  instance_type = var.instance_type

  lifecycle {
    precondition {
      condition     = data.aws_ami.app.architecture == "x86_64"
      error_message = "The selected AMI must use x86_64."
    }
  }
}

check "private_subnet_only" {
  assert {
    condition     = startswith(aws_instance.app.private_dns, "ip-")
    error_message = "Instance must remain on the private network path."
  }
}

Make plan review machine-friendly, but not casual

• Use JSON output for automation, but remember that machine-readable artifacts often reveal more than terminal output.
• Keep retention short for plan files and JSON reports if they can contain secrets or network topology details.
• Restrict who can download build artifacts from CI.

Test modules without pretending they are static files

• terraform test and tofu test are useful for module contracts and assertions.
• Tests can create real infrastructure, so run them in dedicated accounts or isolated projects with cleanup discipline.

terraform test -test-directory=tests -filter=tests/outputs.tftest.hcl

tofu test -test-directory=tests -filter=tests/outputs.tftest.hcl

When to Choose Which

Choose Terraform when:

• Your delivery model already depends on HCP Terraform or Terraform Enterprise workflows.
• Your team wants the smallest process change from an existing HashiCorp-centered platform.
• Your encryption, access control, and audit posture are already solved at the backend and platform layers.

Choose OpenTofu when:

• You want native state and plan encryption in the toolchain itself.
• You want OCI-based provider mirror options and a more open governance story.
• You need near-drop-in workflow familiarity but want extra control over artifact handling.

Shared non-negotiables

• Keep state out of Git.
• Review lock-file changes in code review.
• Restrict artifact downloads for plans and JSON exports.
• Treat -target as a recovery lever, not a normal deployment feature.