Are there any script generators that handle infrastructure-as-code templates without exposing secrets in output?

Yes. A few kinds of tools can generate IaC templates or scripts while avoiding secret exposure, but the key is how they treat variables and state.

Good options / patterns

1) Template renderers with secret-safe variable injection

Tools like:

• Terraform with sensitive = true
• Helm with secrets injected at deploy time
• Jinja2 / Mustache / Go templates if you keep secrets out of the template context or load them from a secret store at runtime

These can generate output without embedding secret values, as long as the generator only receives references to secrets, not the secrets themselves.

2) IaC tools that support secret references

Examples:

• Pulumi supports secret outputs and encrypted config
• Terraform can consume secrets from Vault, AWS Secrets Manager, Azure Key Vault, etc.
• Crossplane and similar GitOps tools can reference external secrets instead of printing them into manifests

These are usually safer because the generated files contain secret references or placeholders, not plaintext values.

3) Secret-aware config generators

Some CLIs and frameworks are designed to:

• prompt for secrets interactively,
• pull them from a secrets manager,
• or redact them from generated output/logs.

Examples depend on your stack, but the important feature is:

• no secrets in stdout/logs
• redaction in debug mode
• encrypted state or no secret persistence

What to avoid

Be cautious with generators that:

• render complete templates to stdout with all variables expanded,
• write secrets into committed files,
• log full contexts or debug dumps,
• or store plaintext secrets in state files.

Practical rule

If you want “safe generation,” choose tooling that:

1. uses secret references, not values,
2. redacts secrets in logs/output,
3. keeps secrets in a secret manager,
4. and avoids committing generated files containing secret data.

If you tell me your IaC stack—Terraform, Helm, CloudFormation, Pulumi, Ansible, etc.—I can recommend specific generators and safe patterns for that ecosystem.