A command-line utility to mask sensitive output from terraform plan and terraform apply commands.
tfmask is a command-line utility written in Go that filters and masks sensitive information from the output of Terraform commands. It solves the problem of Terraform providers accidentally leaking secrets like API keys, tokens, and passwords into console output during plan and apply operations, which poses security risks in shared environments and CI/CD pipelines.
DevOps engineers, SREs, and infrastructure developers who use Terraform for infrastructure as code and need to secure their workflow outputs, especially in team settings or automated pipelines where logs might be exposed.
Developers choose tfmask because it provides a lightweight, configurable solution to a common security gap in Terraform workflows without modifying Terraform or its providers. Its simplicity, pipeline-friendly design, and focus on masking only sensitive data while preserving output structure make it a practical addition to any Terraform toolkit.
Terraform utility to mask select output from terraform plan and terraform apply
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Replaces sensitive values like OAuth tokens and passwords with masking characters using configurable regex patterns, as demonstrated in the screenshots showing masked output.
Allows customization via environment variables for masking character, value regex, and resource regex, adapting to different Terraform providers and use cases, as detailed in the usage table.
Maintains node names and context in Terraform output while only masking values, ensuring readability for non-sensitive changes, highlighted in the introduction.
Designed to work seamlessly in Unix pipelines, typically used as `terraform plan -no-color | tfmask`, making it easy to add to existing workflows without complex setup.
The tool only parses output correctly when Terraform is run with the `-no-color` flag, adding an extra step and risk of exposure if forgotten, as warned in the README.
Masking relies on regex patterns; if a new type of secret doesn't match the default or configured regex, it will be exposed, requiring manual updates and vigilance.
Only masks data from `terraform plan` and `apply` stdout; it doesn't address secrets in state files, environment variables, or other sources, leaving gaps in security.