Sensitive variables in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Sensitive Variables in Terraform

What is the primary purpose of marking a variable as sensitive = true in Terraform?

A To prevent the variable's value from being displayed in Terraform plan and apply outputs.

B To encrypt the variable's value in the state file automatically.

C To make the variable read-only and prevent changes after initial assignment.

D To allow the variable to be used only in provider configurations.

💡 Hint

Think about what happens when Terraform shows outputs during execution.

Marking a variable as sensitive hides its value from Terraform's output logs and plan/apply outputs to avoid accidental exposure. It does not encrypt the state file or restrict usage.

❓ Configuration

intermediate

Terraform Sensitive Variable Declaration

Which Terraform variable declaration correctly marks the variable db_password as sensitive?

A

variable "db_password" {
  type = string
  secret = true
}

B

variable "db_password" {
  type = string
  sensitive = true
}

C

variable "db_password" {
  type = string
  hidden = true
}

D

variable "db_password" {
  type = string
  secure = true
}

💡 Hint

Check the exact attribute name Terraform uses for marking variables as sensitive.

The correct attribute is sensitive = true. Other attribute names like secret, hidden, or secure are invalid and cause errors.

❓ service_behavior

advanced

Effect of Sensitive Variables on Terraform Outputs

Given this Terraform output block:

output "db_password" {
  value     = var.db_password
  sensitive = true
}

What will happen when you run terraform apply?

A The output value will not be shown in the CLI output after apply.

B Terraform will throw an error because outputs cannot be sensitive.

C Terraform will display the output value but mask it with asterisks.

D Terraform will encrypt the output value in the state file automatically.

💡 Hint

Consider how Terraform treats outputs marked as sensitive during apply.

Outputs marked as sensitive are hidden from CLI output after apply to avoid exposing secrets. The state file still contains the value unencrypted.

❓ security

advanced

Security Implications of Sensitive Variables in Terraform State

Which statement about sensitive variables and Terraform state files is true?

A Terraform automatically removes sensitive variables from the state file after apply.

B Sensitive variables are encrypted in the Terraform state file by default.

C Sensitive variables are stored in plain text in the Terraform state file unless additional encryption is configured.

D Sensitive variables cannot be stored in the state file at all.

💡 Hint

Think about what Terraform does with sensitive data internally.

Terraform stores sensitive variables in the state file in plain text by default. To protect them, you must use backend encryption or external secrets management.

❓ Architecture

expert

Best Practice for Managing Sensitive Variables in Terraform Architecture

You want to manage sensitive variables like API keys securely in Terraform for a team project. Which approach is the best practice?

A Store sensitive variables in Terraform variable files checked into version control with <code>sensitive = true</code> set.

B Hardcode sensitive variables directly in Terraform configuration files for simplicity.

C Disable sensitive marking and rely on team members to not share outputs or logs.

D Use environment variables or a secrets manager and pass sensitive variables at runtime without storing them in code or state files.

💡 Hint

Consider how to avoid exposing secrets in code and state files.

Best practice is to avoid storing secrets in code or state files. Using environment variables or external secrets managers keeps sensitive data out of version control and reduces exposure risk.

Practice

1.

What is the main purpose of marking a variable as sensitive in Terraform?

easy

A. To hide the variable's value from Terraform plan and apply outputs

B. To make the variable read-only

C. To encrypt the variable in the state file automatically

D. To allow the variable to be used only in modules

Solution

1. Step 1: Understand what sensitive means in Terraform

   Marking a variable as sensitive tells Terraform not to show its value in command outputs like plan or apply, protecting secrets from accidental exposure.

2. Step 2: Clarify what sensitive does not do automatically

   Sensitive does not make the variable read-only, nor does it encrypt the state file automatically. It only hides the value in outputs.

3. Final Answer:

   To hide the variable's value from Terraform plan and apply outputs -> Option A

4. Quick Check:

   Sensitive hides values in outputs = B [OK]

Hint: Sensitive hides secrets in outputs, not encryption [OK]

Common Mistakes:

• Thinking sensitive encrypts the state file
• Confusing sensitive with read-only variables
• Believing sensitive restricts variable usage

2.

Which of the following is the correct way to declare a sensitive variable in Terraform?

variable "db_password" {
  type = string
  sensitive = true
}

easy

A. variable "db_password" { sensitive = true; type = string }

B. variable "db_password" { type = string sensitive = true }

C. variable "db_password" { type = string; sensitive = true }

D. variable "db_password" { sensitive: true type: string }

Solution

1. Step 1: Recall Terraform variable block syntax

   Terraform uses HCL syntax where attributes are set with key = value pairs separated by new lines or spaces.

2. Step 2: Identify correct attribute order and syntax

   Attributes order does not matter, but semicolons or colons are invalid in HCL. So sensitive = true and type = string with equals signs and no semicolons is correct.

3. Final Answer:

   variable "db_password" { type = string sensitive = true } -> Option B

4. Quick Check:

   Correct HCL syntax uses equals and no semicolons = A [OK]

Hint: Use equals signs and no semicolons in Terraform blocks [OK]

Common Mistakes:

• Using semicolons or colons instead of equals
• Putting attributes on the same line without proper syntax
• Incorrect attribute order causing confusion

3.

Given this Terraform code snippet, what will be the output of terraform apply regarding the db_password variable?

variable "db_password" {
  type = string
  sensitive = true
}

output "password_output" {
  value = var.db_password
  sensitive = true
}

medium

A. The password value will be hidden in the output after apply

B. The password value will be shown in the output after apply

C. Terraform will throw a syntax error due to sensitive output

D. The password value will be printed in the plan but hidden in apply

Solution

1. Step 1: Understand sensitive variable and output behavior

   Marking a variable and output as sensitive hides their values from Terraform CLI outputs during plan and apply.

2. Step 2: Check if syntax allows sensitive outputs

   Terraform supports marking outputs as sensitive to prevent showing secret values. No syntax error occurs.

3. Final Answer:

   The password value will be hidden in the output after apply -> Option A

4. Quick Check:

   Sensitive outputs hide values in apply output = A [OK]

Hint: Sensitive outputs hide values in apply output [OK]

Common Mistakes:

• Expecting sensitive values to show in outputs
• Thinking sensitive outputs cause syntax errors
• Confusing plan output with apply output

4.

What is wrong with this Terraform variable declaration if the goal is to keep the value secret?

variable "api_key" {
  type = string
  default = "mysecret"
}

medium

A. Default values cannot be used with sensitive variables

B. The variable type should be secret instead of string

C. The variable is missing sensitive = true to hide the value

D. The variable name must start with secret_

Solution

1. Step 1: Check if variable is marked sensitive

   The variable is not marked with sensitive = true, so its value will be shown in outputs and state.

2. Step 2: Validate other options

   Terraform does not have a secret type, default values are allowed, and variable names have no required prefix.

3. Final Answer:

   The variable is missing sensitive = true to hide the value -> Option C

4. Quick Check:

   Missing sensitive attribute means value not hidden = C [OK]

Hint: Add sensitive = true to hide secret values [OK]

Common Mistakes:

• Assuming type secret exists
• Thinking default values are forbidden for secrets
• Believing variable names must have secret prefix

5.

You want to pass a sensitive database password from a Terraform module to the root module without exposing it in any output or logs. Which approach is best?

hard

A. Use a non-sensitive variable and rely on Terraform state encryption

B. Pass the password as a normal variable and print it in the root output for verification

C. Store the password in a plain text file and read it in both modules

D. Mark the variable as sensitive in the module and mark the output as sensitive in the module and root

Solution

1. Step 1: Protect sensitive data in modules

   Marking variables and outputs as sensitive in both the module and root prevents accidental exposure in CLI outputs and logs.

2. Step 2: Avoid insecure practices

   Printing secrets in outputs, storing in plain text files, or relying only on state encryption risks exposure.

3. Final Answer:

   Mark the variable as sensitive in the module and mark the output as sensitive in the module and root -> Option D

4. Quick Check:

   Mark sensitive in variables and outputs to keep secrets safe = D [OK]

Hint: Mark sensitive on variables and outputs in all modules [OK]

Common Mistakes:

• Printing secrets in outputs for debugging
• Storing secrets in plain text files
• Assuming state encryption alone is enough