GitHub Actions Environment Secrets defined in Terraform are not encrypted misconfiguration detected

Rule Details

Cortex AppSec Rule ID	APPSEC_GIT_4
Category - Subcategory	Storage - Encryption
Provider	OTHER
Severity	HIGH
Framework	Terraform

Impact

In the GitHub Terraform provider, there is an optional field to include a plaintext string of the secret. If this is checked into code, it will expose the secret.

How to Fix

Resource: github_actions_environment_secret, github_actions_organization_secret, github_actions_secret

• Attribute: plaintext_value [source,go]

---

resource "github_actions_environment_secret" "test_secret" {

...

• plaintext_value = "example%value" }

---