One Terraform State Leak Can Cross Cloud Boundaries
A readable Terraform state file is not just exposed metadata. It can carry the live credentials an automation flow used to build and manage resources, so one leak can become a trust bridge into the accounts that identity already reaches.
In the pentest, an overly permissive S3 bucket exposed a state file that yielded GitHub app credentials, which then opened Azure and led to administrator access in another AWS account. The point is not the bucket alone. The real attack surface is every identity allowed to read, copy, and reuse state or the automation tokens inside it.
Secret managers help, but they do not fix a state file that is readable by the wrong principals. For teams running Terraform across S3, GitHub, Azure, and AWS, this is a cross-provider escalation path, not a simple leak of configuration.