SSM Parameter should not store credential value as plaintext in Terraform

What it checks

SSM parameter: value appears to contain a hardcoded credential or token.

Where it applies

Terraform: aws_ssm_parameter

CloudFormation: AWS::SSM::Parameter

How to fix it

1. Replace the hardcoded value with a sensitive Terraform variable (sensitive = true). Pass the value via tfvars (gitignored) or a secrets vault integration.
2. Rotate the exposed credential immediately — it is already in your Git history and Terraform state file.

Frameworks

• SOC 2 CC6.1

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules