Terraform state is the record Terraform keeps about the infrastructure it manages. It maps the resources defined in code to the real cloud objects already created, so Terraform can plan changes instead of rebuilding everything from scratch. Because it tracks resource IDs, names, endpoints, and dependencies, the state file can expose sensitive cloud metadata and, in some setups, secrets or credential references.
This matters because attackers often look for state files in exposed development servers, misconfigured web roots, or public storage. A leaked Terraform state can reveal how an environment is built, which services exist, and where high-value cloud assets live. Even if passwords are not stored directly, the file may contain enough detail to support later attacks, such as targeting databases, token stores, or IAM roles. Defenders should keep state files out of public paths, use remote backends with strong access controls, encrypt state at rest, and rotate any secrets found in a compromised copy.