tfmask
A command-line utility to mask sensitive output from terraform plan and terraform apply commands.
What is tfmask?
tfmask is a command-line utility written in Go that filters and masks sensitive information from the output of Terraform commands. It solves the problem of Terraform providers accidentally leaking secrets like API keys, tokens, and passwords into console output during plan and apply operations, which poses security risks in shared environments and CI/CD pipelines.
DevOps engineers, SREs, and infrastructure developers who use Terraform for infrastructure as code and need to secure their workflow outputs, especially in team settings or automated pipelines where logs might be exposed.
Developers choose tfmask because it provides a lightweight, configurable solution to a common security gap in Terraform workflows without modifying Terraform or its providers. Its simplicity, pipeline-friendly design, and focus on masking only sensitive data while preserving output structure make it a practical addition to any Terraform toolkit.
Overview
Terraform utility to mask select output from terraform plan and terraform apply
Use Cases
Best For
- Securing Terraform output in CI/CD pipelines to prevent secret leakage in build logs
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
