Sensitive output values in Terraform - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to mark the output value as sensitive.

Terraform

output "db_password" {
  value     = aws_db_instance.example.password
  sensitive = [1]
}

Drag options to blanks, or click blank then click option'

Afalse

Btrue

C"true"

Dyes

Attempts:

3 left

💡 Hint

Common Mistakes

Using string "true" instead of boolean true

Setting sensitive to false or yes

Setting sensitive = true hides the output value from normal display.

2fill in blank

medium

Complete the code to output the database endpoint without exposing it as sensitive.

Terraform

output "db_endpoint" {
  value     = aws_db_instance.example.endpoint
  sensitive = [1]
}

Drag options to blanks, or click blank then click option'

Afalse

Btrue

C"false"

Dno

Attempts:

3 left

💡 Hint

Common Mistakes

Using string "false" instead of boolean false

Setting sensitive to true hides the output

Setting sensitive = false allows the output to be visible.

3fill in blank

hard

Fix the error in the output block to correctly mark the secret key as sensitive.

Terraform

output "secret_key" {
  value     = aws_secretsmanager_secret.example.secret_string
  sensitive = [1]
}

Drag options to blanks, or click blank then click option'

A"true"

B1

Ctrue

Dyes

Attempts:

3 left

💡 Hint

Common Mistakes

Using string "true" instead of boolean true

Using yes or 1 which are invalid

The sensitive attribute must be a boolean true, not a string or other value.

4fill in blank

hard

Fill both blanks to output the admin password as sensitive and add a description.

Terraform

output "admin_password" {
  value       = aws_iam_user.admin.password
  sensitive   = [1]
  description = [2]
}

Drag options to blanks, or click blank then click option'

Atrue

Bfalse

C"The admin user password"

D"Admin password output"

Attempts:

3 left

💡 Hint

Common Mistakes

Setting sensitive to false exposes the password

Not quoting the description string

Marking sensitive = true hides the password. Adding a description helps document the output.

5fill in blank

hard

Fill all three blanks to output the API key as sensitive, with a description and a custom export name.

Terraform

output "api_key" {
  value       = aws_api_gateway_api_key.example.value
  sensitive   = [1]
  description = [2]
  export_name = [3]
}

Drag options to blanks, or click blank then click option'

Atrue

B"API key for external use"

C"external_api_key"

Dfalse

Attempts:

3 left

💡 Hint

Common Mistakes

Using false for sensitive exposes the key

Not quoting description or export_name

Setting sensitive = true hides the key. Description and export_name are strings that document and name the output.

Practice

1. What is the main purpose of marking an output as sensitive = true in Terraform?

easy

A. To hide the output value from the standard Terraform output display

B. To make the output value publicly accessible

C. To increase the output value size limit

D. To automatically encrypt the output value in the state file

Solution

1. Step 1: Understand the role of sensitive outputs

   Marking an output as sensitive hides it from the normal Terraform output display to protect secrets.

2. Step 2: Clarify what sensitive does not do

   Sensitive does not make outputs public, increase size, or encrypt state automatically.

3. Final Answer:

   To hide the output value from the standard Terraform output display -> Option A

4. Quick Check:

   sensitive output hides value [OK]

Hint: Sensitive outputs hide secrets from console output [OK]

Common Mistakes:

• Thinking sensitive makes output public
• Assuming sensitive encrypts state file
• Believing sensitive increases output size

2. Which of the following is the correct syntax to declare a sensitive output in Terraform?

easy

A. output "db_password" { value = var.db_password
sensitive = true }

B. output "db_password" { value = var.db_password sensitive = true }

C. output "db_password" { value = var.db_password; sensitive = true }

D. output "db_password" { value = var.db_password, sensitive = true }

Solution

1. Step 1: Recall Terraform block syntax

   Terraform blocks use new lines or spaces between arguments without semicolons or commas.

2. Step 2: Identify correct syntax for sensitive output

   The correct syntax places sensitive = true on a new line inside the output block without semicolons or commas.

3. Final Answer:

   output "db_password" { value = var.db_password sensitive = true } -> Option A

4. Quick Check:

   Terraform blocks use new lines, no semicolons [OK]

Hint: Terraform blocks use new lines, no semicolons or commas [OK]

Common Mistakes:

• Using semicolons inside blocks
• Using commas between arguments
• Placing sensitive outside the output block

3. Given this Terraform output declaration:

output "api_key" {
  value     = var.api_key
  sensitive = true
}

What will Terraform display when you run terraform output?

medium

A. The actual API key value

B. An error saying output is sensitive

C. No output at all

D. <sensitive> placeholder instead of the value

Solution

1. Step 1: Understand sensitive output display behavior

   Terraform replaces sensitive output values with <sensitive> to avoid showing secrets.

2. Step 2: Confirm output command behavior

   Running terraform output shows <sensitive> for sensitive outputs, not the real value or errors.

3. Final Answer:

   <sensitive> placeholder instead of the value -> Option D

4. Quick Check:

   sensitive outputs show <sensitive> [OK]

Hint: Sensitive outputs show <sensitive> instead of real value [OK]

Common Mistakes:

• Expecting actual secret value to display
• Thinking terraform throws error for sensitive outputs
• Assuming no output is shown at all

4. You wrote this output block:

output "admin_password" {
  value = var.admin_password
  sensitive = "true"
}

Terraform gives an error. What is the problem?

medium

A. The value attribute cannot reference variables

B. The sensitive attribute must be a boolean, not a string

C. The output name cannot be admin_password

D. Missing a comma between value and sensitive

Solution

1. Step 1: Check the sensitive attribute type

   The sensitive attribute expects a boolean (true/false), not a string with quotes.

2. Step 2: Identify the error cause

   Using quotes around true makes it a string, causing Terraform syntax error.

3. Final Answer:

   The sensitive attribute must be a boolean, not a string -> Option B

4. Quick Check:

   sensitive = true (no quotes) [OK]

Hint: Boolean values in Terraform have no quotes [OK]

Common Mistakes:

• Putting quotes around boolean true/false
• Adding commas inside blocks
• Misnaming output blocks

5. You want to output a database password securely and also allow other Terraform configurations to access it without exposing it in the console. Which approach is best?

hard

A. Store the password in a public output without sensitive flag

B. Print the password normally in output and rely on user caution

C. Declare output with sensitive = true and use terraform output -json to pass value programmatically

D. Remove the output block and hardcode the password in other configs

Solution

1. Step 1: Protect password in output

   Marking output as sensitive hides it from console output, preventing accidental exposure.

2. Step 2: Enable programmatic access

   Using terraform output -json allows other configs or scripts to read the secret safely without showing it on screen.

3. Final Answer:

   Declare output with sensitive = true and use terraform output -json to pass value programmatically -> Option C

4. Quick Check:

   Use sensitive output + json output for safe secret sharing [OK]

Hint: Use sensitive output plus JSON output for safe secret sharing [OK]

Common Mistakes:

• Printing secrets openly in outputs
• Hardcoding secrets in configs
• Ignoring sensitive flag for secrets