Is there a plan to encrypt .tfvars files in CICD repos?

[v-wan]

Interested about the feasibility of using KMS + SOPS to encrypt the .tfvars files so it does not get revealed in the stage CICD repositories.

[ludoo]

Why would you want to encrypt tfvars? They do not typically contain sensitive data, except possibly for the VPN secrets but that would be better handled at the VPN module level by using Secret Manager.

[v-wan]

Thanks for answering, we are trying to keep the repo security as tight as possible, like hiding values such as billing ID. For now we are using the KMS keys in the security stage for encryption.