Skip to content
Sarj Sarj Sarj Standards

no-plaintext-secret-env

A secret-named container environment variable should come from a secret reference, not a plain value.

SARJ214 Rule source Tests Catalog JSON

Why

A plain value copies the secret into Terraform state, the plan output and the service revision, where anyone who can read them sees it, and rotating it needs a redeploy.

Fix

Store the secret in Secret Manager and reference it with value_source { secret_key_ref { ... } } or value_from { secret_key_ref { ... } }.

Examples

Before — flagged An API key is injected as a plain value
main.tf
resource "google_cloud_run_v2_service" "api" {
  template {
    containers {
      env {
        name  = "API_KEY"
        value = var.api_key
      }
    }
  }
}
After — preferred An API key is read from Secret Manager
main.tf
resource "google_cloud_run_v2_service" "api" {
  template {
    containers {
      env {
        name = "API_KEY"
        value_source {
          secret_key_ref {
            secret  = google_secret_manager_secret.api_key.secret_id
            version = "latest"
          }
        }
      }
    }
  }
}