Sensitive variables in Terraform - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a sensitive variable in Terraform?

A sensitive variable is a variable that holds secret or private information, like passwords or keys, which Terraform hides from output to keep it safe.

beginner

How do you declare a sensitive variable in Terraform?

You declare a variable with the attribute sensitive = true inside the variable block to mark it as sensitive.

beginner

Why should sensitive variables not be printed in Terraform outputs?

Printing sensitive variables can expose secrets in logs or terminal, risking security. Terraform hides them to protect sensitive data.

intermediate

Can sensitive variables be used in Terraform resource configurations?

Yes, sensitive variables can be used normally in resource configurations, but Terraform will avoid showing their values in plan or apply outputs.

intermediate

What happens if you try to output a sensitive variable without marking the output as sensitive?

Terraform will warn you and hide the value in the output to prevent accidental exposure of secrets.

How do you mark a variable as sensitive in Terraform?

A Prefix the variable name with 'secret_'

B Use <code>private = true</code> in the variable block

C Add <code>sensitive = true</code> in the variable block

D Set <code>hidden = true</code> in the variable block

The correct way is to add sensitive = true inside the variable block.

What does Terraform do when you output a sensitive variable without marking the output as sensitive?

A Shows the value normally

B Throws an error and stops

C Deletes the variable

D Hides the value and shows a warning

Terraform hides the sensitive value and warns you to avoid exposing secrets.

Why should sensitive variables be used in Terraform?

A To keep secret information safe

B To store large data files

C To speed up Terraform runs

D To make variables public

Sensitive variables keep secret information like passwords safe by hiding them.

Can you use sensitive variables inside resource definitions?

A Yes, but values are hidden in outputs

B No, Terraform blocks it

C Only if you disable sensitivity

D Only for string variables

Sensitive variables can be used normally in resources, but Terraform hides their values in outputs.

What is a best practice when handling sensitive variables in Terraform?

A Store them in plain text files

B Mark them as sensitive and avoid printing

C Share them in team chats

D Print them in logs for debugging

Marking variables as sensitive and avoiding printing them protects secrets.

Explain how to declare and use sensitive variables in Terraform and why it is important.

Think about how you keep passwords safe in real life.

Describe what happens when you output a sensitive variable without marking the output as sensitive in Terraform.

Terraform acts like a privacy guard for secrets.