In Terraform, non-human identities are automated actors—service accounts, CI/CD pipelines, and application roles—that hold the keys to your infrastructure. They don’t sleep. They don’t forget. They run every time your plan applies, every time your modules deploy, often with more privileges than necessary. Left unchecked, they become invisible risks.
Managing non-human identities in Terraform begins with defining them as resources. Use aws_iam_role, google_service_account, or azurerm_role_definition blocks to create identities with clear, minimal permissions. Always bind policies at the identity level, not inline in code that runs once and gets lost. Move secrets and credentials into secure state backends like AWS SSM, GCP Secret Manager, or Vault, away from public repos and ephemeral build logs.
Version control every non-human identity. When Terraform code changes, the drift between definition and reality must be zero. Enforce this with policy-as-code tools like Sentinel or Open Policy Agent. Scan the state file regularly for unexpected identities or privilege escalations. Rotate credentials automatically; Terraform can trigger automation that regenerates keys and updates dependent resources without downtime.