Sensitive output values in Terraform - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does marking an output as sensitive in Terraform do?

It hides the output value from the CLI output and logs to protect sensitive information like passwords or keys.

beginner

How do you declare a sensitive output in Terraform?

Use the sensitive = true argument inside the output block, for example:<br>

output "db_password" {
  value     = aws_db_instance.example.password
  sensitive = true
}

beginner

Why should sensitive outputs not be printed in logs or shared publicly?

Because they may contain secrets like passwords or API keys that can compromise security if exposed.

intermediate

Can sensitive outputs be accessed programmatically in Terraform?

Yes, sensitive outputs can be used by other Terraform configurations or modules but remain hidden in CLI output and logs.

beginner

What happens if you do not mark a sensitive value as sensitive in Terraform outputs?

The value will be shown in the CLI output and stored in the state file in plain text, risking exposure of secrets.

What keyword do you use to mark an output as sensitive in Terraform?

A private = true

B sensitive = true

C hidden = true

D secure = true

Terraform uses sensitive = true inside the output block to mark outputs as sensitive.

What is the main benefit of marking outputs as sensitive?

A They are hidden from CLI output and logs

B They are encrypted in the state file

C They run faster

D They can be shared publicly

Sensitive outputs are hidden from CLI output and logs to protect secrets.

If an output is sensitive, can other Terraform modules still use its value?

A No, sensitive outputs are blocked

B Only if you decrypt it manually

C Only in the same module

D Yes, but the value is hidden in CLI output

Sensitive outputs can be used programmatically but remain hidden in CLI output.

What risk do you take if you do NOT mark a secret output as sensitive?

A The secret will be exposed in CLI output and state files

B Terraform will fail to apply

C The output will be encrypted automatically

D There is no risk

Not marking secrets as sensitive exposes them in CLI output and state files.

Which of these is NOT a recommended practice for sensitive outputs?

A Mark outputs as sensitive

B Avoid printing secrets in logs

C Store secrets in plain text outputs

D Use outputs carefully in automation

Storing secrets in plain text outputs is not recommended.

Explain how to protect sensitive information in Terraform outputs and why it matters.

Think about what happens if secrets are shown in logs or terminal.

Describe the behavior of sensitive outputs in Terraform when accessed by other modules or automation.

Consider how Terraform shares outputs internally vs. what it shows to users.