Best Practices for Managing Secrets with Terraform and Vault?

Hi everyone!

I’ve been using Terraform to manage infrastructure, and I’m starting to integrate Vault for secret storage. I’m curious how others handle secret management cleanly and securely with Terraform — especially when provisioning resources that need dynamic credentials.

A few specific questions I have:

  • Do you store Vault paths/roles in Terraform variables or external providers?
  • How do you avoid exposing secrets in logs/state files?
  • Any recommended patterns for rotating credentials managed by Terraform?

Would love to hear your real-world workflows or tips! Thanks in advance