Create the secret's place in code and its value in the store

How to do it

Declare the secret in the infrastructure code, with its name, its encryption key and the one role that may read it. Leave the value out. The store generates it, or the database service manages it, as RDS does with manage_master_user_password. Plain settings, such as a region or a feature limit, go in the variables file or a parameter store.

Example

resource "aws_secretsmanager_secret" "payment_api_key" {
  name       = "production/shop/payment-api-key"
  kms_key_id = aws_kms_key.secrets.arn
  tags       = { owner = "payments-team" }
}

resource "aws_db_instance" "orders" {
  identifier                  = "shop-orders"
  username                    = "shop_admin"
  manage_master_user_password = true   # the database service creates and rotates it
}

# Fails when a secret argument holds a literal value
! grep -rnE '(secret_string|password|private_key|secret_key|access_key|api_key) *= *"[^"]+"' infra --include=*.tf

How to check

The grep below finds no secret_string, password or key argument set to a quoted literal. Every secret in the store has an owner tag and exactly one reading role.