It would be nice to have linting rules against secrets in state and promote the usage of ephemeral resources and write only arguments: https://developer.hashicorp.com/terraform/language/resources/ephemeral.

Resources with write-only arguments:

• aws_secretsmanager_secret_version: included in Validate against sensitive attributes, recommending write-only arguments #860

• aws_rds_cluster: included in Validate against sensitive attributes, recommending write-only arguments #860

• aws_db_instance: included in Validate against sensitive attributes, recommending write-only arguments #860

• aws_redshift_cluster: included in Validate against sensitive attributes, recommending write-only arguments #860

• aws_docdb_cluster: included in Validate against sensitive attributes, recommending write-only arguments #860

• aws_redshiftserverless_namespace: included in Validate against sensitive attributes, recommending write-only arguments #860

• aws_ssm_parameter: included in Validate against sensitive attributes, recommending write-only arguments #860

Data sources that have ephemeral equivalents:

• aws_ssm_parameter: included in feat: warn against data sources with ephemeral alternatives #861
• aws_secretsmanager_secret_version : included in feat: warn against data sources with ephemeral alternatives #861
• aws_secretsmanager_random_password : included in feat: warn against data sources with ephemeral alternatives #861
• aws_eks_cluster_auth: included in feat: warn against data sources with ephemeral alternatives #861
• aws_kms_secrets: included in feat: warn against data sources with ephemeral alternatives #861
• aws_lambda_invocation: included in feat: warn against data sources with ephemeral alternatives #861

Questions to be answered:

• This is a TF 1.11+ feature, how to document that?
• This is a security recommendation, should that reside in tflint-ruleset-aws or is trivy a better tool to integrate this in?