Sensitive variables in Terraform - Mini Project: Build & Apply

Managing Sensitive Variables in Terraform

📖 Scenario: You are setting up a Terraform configuration to deploy cloud resources. Some information, like passwords or API keys, must be kept secret to protect your system.

🎯 Goal: Learn how to declare and use sensitive variables in Terraform to keep secrets safe during infrastructure deployment.

📋 What You'll Learn

Declare a sensitive variable in Terraform

Assign a default secret value to the sensitive variable

Use the sensitive variable in a resource configuration

Output the sensitive variable without revealing its value

💡 Why This Matters

🌍 Real World

Cloud engineers often need to manage secrets like passwords and API keys securely when deploying infrastructure with Terraform.

💼 Career

Knowing how to handle sensitive variables is essential for cloud infrastructure roles to prevent accidental exposure of secrets.

1

Declare a sensitive variable

Create a Terraform variable called db_password of type string with the attribute sensitive = true and set its default value to "SuperSecret123".

Terraform

# Declare the sensitive variable 'db_password' here
# Your code here

Need a hint?

Use the variable block with sensitive = true to keep the value secret.

2

Add a resource using the sensitive variable

Add a Terraform resource block for aws_db_instance named example that uses the sensitive variable var.db_password as the password attribute.

Terraform

variable "db_password" {
  type      = string
  sensitive = true
  default   = "SuperSecret123"
}

# Add the aws_db_instance resource using var.db_password as password
# Your code here

Need a hint?

Use var.db_password to reference the sensitive variable inside the resource.

3

Create a sensitive output for the password

Create an output called db_password_output that outputs the sensitive variable var.db_password and mark the output as sensitive = true.

Terraform

variable "db_password" {
  type      = string
  sensitive = true
  default   = "SuperSecret123"
}

resource "aws_db_instance" "example" {
  identifier       = "example-db"
  engine           = "mysql"
  instance_class   = "db.t2.micro"
  username         = "admin"
  password         = var.db_password
  allocated_storage = 20
}

# Create a sensitive output for db_password
# Your code here

Need a hint?

Mark the output as sensitive to avoid showing the secret in Terraform output.

4

Add provider configuration

Add the provider block for aws with the region set to us-east-1.

Terraform

variable "db_password" {
  type      = string
  sensitive = true
  default   = "SuperSecret123"
}

resource "aws_db_instance" "example" {
  identifier       = "example-db"
  engine           = "mysql"
  instance_class   = "db.t2.micro"
  username         = "admin"
  password         = var.db_password
  allocated_storage = 20
}

output "db_password_output" {
  value     = var.db_password
  sensitive = true
}

# Add AWS provider configuration with region us-east-1
# Your code here

Need a hint?

The provider block tells Terraform which cloud and region to use.