I do that on some projects where the IaC is not run often, sensitive contents should be encrypted with the password