Sensitive output values in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens when an output is marked as sensitive in Terraform?

Consider this Terraform output configuration:

output "db_password" {
  value     = aws_db_instance.example.password
  sensitive = true
}

What is the effect of setting sensitive = true on this output?

Terraform

output "db_password" {
  value     = aws_db_instance.example.password
  sensitive = true
}

A Terraform will hide the output value in the CLI and state files, preventing it from being displayed or logged.

B Terraform will encrypt the output value automatically in the cloud provider's console.

C Terraform will print the output value in plain text but mark it with a warning.

D Terraform will prevent the output from being used as an input to other modules.

💡 Hint

Think about what sensitive means for output visibility.

Marking an output as sensitive tells Terraform to hide its value in CLI output and state files to avoid accidental exposure.

❓ Configuration

intermediate

Which Terraform output configuration correctly marks a secret as sensitive?

Choose the correct Terraform output block that marks the secret api_key as sensitive.

A

output "api_key" {
  value = var.api_key
  secret = true
}

B

output "api_key" {
  value = var.api_key
  sensitive = false
}

C

output "api_key" {
  value = var.api_key
  sensitive = true
}

D

output "api_key" {
  value = var.api_key
  hidden = true
}

💡 Hint

Check the exact attribute name Terraform uses for marking outputs sensitive.

The correct attribute to mark outputs as sensitive is sensitive = true. Other attributes like secret or hidden are invalid.

❓ Architecture

advanced

How should sensitive outputs be handled in a multi-team Terraform environment?

You manage Terraform code used by multiple teams. Some outputs contain sensitive data like passwords or keys.

Which approach best protects sensitive outputs while allowing teams to use necessary information?

A Store sensitive outputs in plain text files alongside Terraform code for easy access.

B Remove sensitive outputs from Terraform and share secrets via email to teams.

C Mark sensitive outputs as normal outputs and rely on team trust to not share them.

D Mark sensitive outputs with <code>sensitive = true</code> and share the Terraform state file only with authorized teams.

💡 Hint

Think about controlling access to state files and output visibility.

Marking outputs sensitive hides them in CLI and state files. Sharing state files only with authorized teams protects secrets.

❓ security

advanced

What is a limitation of marking outputs as sensitive in Terraform?

Consider marking outputs as sensitive in Terraform. Which of the following is a true limitation?

A Sensitive outputs cannot be referenced by other modules once marked sensitive.

B Sensitive outputs are still stored in plain text inside the Terraform state file unless additional encryption is applied.

C Sensitive outputs automatically encrypt data at rest in the cloud provider.

D Sensitive outputs prevent Terraform from applying changes to resources.

💡 Hint

Think about where Terraform stores output values and what sensitive controls.

Marking outputs sensitive hides them in CLI and logs but does not encrypt the state file by default. Additional encryption must be configured separately.

✅ Best Practice

expert

Which practice best prevents accidental exposure of sensitive Terraform outputs in CI/CD pipelines?

You run Terraform in a CI/CD pipeline that outputs sensitive values. Which practice best prevents accidental exposure of these sensitive outputs?

A Configure Terraform outputs as sensitive and avoid printing them in pipeline logs or environment variables.

B Print all outputs in the pipeline logs but encrypt the logs after the run.

C Disable sensitive output marking and rely on pipeline access controls only.

D Store sensitive outputs in plain text files checked into the pipeline repository.

💡 Hint

Consider how outputs appear in logs and environment variables during pipeline runs.

Marking outputs sensitive prevents Terraform from printing them in CLI output. Avoid printing them in logs or environment variables to prevent exposure.