For secrets or credentials, I've had a reasonable experience putting the name of the secret into a terraform resource, but then setting the secret's actual value outside of terraform (i.e. via web or cli).

This avoids storing the secret's value in the state file (it's stored as an empty string) and also keeps the terraform plan clean.