Privacy

Terraform state files contain secrets in plain text: generated passwords, connection strings, and access keys all live inside instance attributes.

What cloudexit reads

cloudexit never copies instance attributes. Only four values leave the state file for any resource: its address, its Terraform type, its location, and the count it contributes.

To describe the assessed scope, the report also records the state’s own identifiers — file name and SHA-256, lineage and serial — and, for Azure, the subscription and resource group parsed out of resource ids. These are the same identifiers a live assessment already prints in its scope table.

A live assessment writes raw API responses to raw_data/resource_inventory_raw_data.json. State scans deliberately do not mirror that. Instead they write a manifest:

{
  "source_file": "infra.tfstate",
  "terraform_version": "1.14.6",
  "state_serial": 7,
  "counted": [
    {
      "address": "module.storage.aws_s3_bucket.this[0]",
      "type": "aws_s3_bucket",
      "resource_type_id": 293,
      "location": "eu-central-1"
    }
  ],
  "unmapped_types": { "aws_s3_bucket_versioning": 3 }
}

Only the basename of the state file is recorded, never its full path. Where a location is derived from an ARN, only the region field is taken — the AWS account id is never extracted.

Your responsibility

cloudexit makes no network calls in this mode, so nothing from your state file leaves the machine. The state file itself remains sensitive: keep it out of version control, and remove anything you export with terraform state pull when a CI job finishes.