Sensitive variables in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Sensitive Variables in Terraform

What is the primary purpose of marking a variable as sensitive = true in Terraform?

A To prevent the variable's value from being displayed in Terraform plan and apply outputs.

B To encrypt the variable's value in the state file automatically.

C To make the variable read-only and prevent changes after initial assignment.

D To allow the variable to be used only in provider configurations.

💡 Hint

Think about what happens when Terraform shows outputs during execution.

Marking a variable as sensitive hides its value from Terraform's output logs and plan/apply outputs to avoid accidental exposure. It does not encrypt the state file or restrict usage.

❓ Configuration

intermediate

Terraform Sensitive Variable Declaration

Which Terraform variable declaration correctly marks the variable db_password as sensitive?

A

variable "db_password" {
  type = string
  secret = true
}

B

variable "db_password" {
  type = string
  sensitive = true
}

C

variable "db_password" {
  type = string
  hidden = true
}

D

variable "db_password" {
  type = string
  secure = true
}

💡 Hint

Check the exact attribute name Terraform uses for marking variables as sensitive.

The correct attribute is sensitive = true. Other attribute names like secret, hidden, or secure are invalid and cause errors.

❓ service_behavior

advanced

Effect of Sensitive Variables on Terraform Outputs

Given this Terraform output block:

output "db_password" {
  value     = var.db_password
  sensitive = true
}

What will happen when you run terraform apply?

A The output value will not be shown in the CLI output after apply.

B Terraform will throw an error because outputs cannot be sensitive.

C Terraform will display the output value but mask it with asterisks.

D Terraform will encrypt the output value in the state file automatically.

💡 Hint

Consider how Terraform treats outputs marked as sensitive during apply.

Outputs marked as sensitive are hidden from CLI output after apply to avoid exposing secrets. The state file still contains the value unencrypted.

❓ security

advanced

Security Implications of Sensitive Variables in Terraform State

Which statement about sensitive variables and Terraform state files is true?

A Terraform automatically removes sensitive variables from the state file after apply.

B Sensitive variables are encrypted in the Terraform state file by default.

C Sensitive variables are stored in plain text in the Terraform state file unless additional encryption is configured.

D Sensitive variables cannot be stored in the state file at all.

💡 Hint

Think about what Terraform does with sensitive data internally.

Terraform stores sensitive variables in the state file in plain text by default. To protect them, you must use backend encryption or external secrets management.

❓ Architecture

expert

Best Practice for Managing Sensitive Variables in Terraform Architecture

You want to manage sensitive variables like API keys securely in Terraform for a team project. Which approach is the best practice?

A Store sensitive variables in Terraform variable files checked into version control with <code>sensitive = true</code> set.

B Hardcode sensitive variables directly in Terraform configuration files for simplicity.

C Disable sensitive marking and rely on team members to not share outputs or logs.

D Use environment variables or a secrets manager and pass sensitive variables at runtime without storing them in code or state files.

💡 Hint

Consider how to avoid exposing secrets in code and state files.

Best practice is to avoid storing secrets in code or state files. Using environment variables or external secrets managers keeps sensitive data out of version control and reduces exposure risk.