Sensitive variables in Terraform - Step-by-Step Execution

Process Flow - Sensitive variables

Define variable with sensitive = true

↓

Terraform reads variable

↓

Value is marked sensitive

↓

Use variable in resources or outputs

↓

Terraform hides value in CLI output

↓

Value stored securely in state file

↓

Apply or plan runs without exposing value

Terraform marks variables as sensitive to hide their values in outputs and logs, protecting secrets during deployment.

Execution Sample

Terraform

variable "db_password" {
  type      = string
  sensitive = true
}

output "db_password" {
  value     = var.db_password
  sensitive = true
}

Defines a sensitive variable and outputs it without revealing the actual value in CLI or logs.

Process Table

Step	Action	Variable State	Output Behavior	Notes
1	Define variable db_password with sensitive=true	db_password marked sensitive	No output yet	Variable is flagged sensitive
2	Terraform reads variable value during plan	db_password value loaded securely	Value hidden in plan output	Sensitive flag prevents showing value
3	Use variable in resource or output	db_password remains sensitive	Output shows <sensitive> placeholder	Actual value not printed
4	Terraform writes state file	Sensitive value stored securely	No value leakage	State file protects sensitive data
5	Run terraform apply	Sensitive variable used internally	CLI output hides value	Sensitive data safe from exposure
6	Attempt to print output without sensitive flag	Value still sensitive	Output shows <sensitive>	Terraform enforces hiding
7	Output with sensitive=true set	Value remains sensitive	Output masked as <sensitive>	Explicit sensitive output
8	End of execution	Sensitive variable protected	No sensitive data shown	Execution ends safely

💡 Terraform execution ends with sensitive variables protected from CLI and log exposure

Status Tracker

Variable	Defined	After Plan	After Apply	Final
db_password	sensitive=true, value hidden	value loaded, hidden in output	used internally, hidden in CLI	remains sensitive, never exposed

Key Moments - 3 Insights

Why does Terraform show <sensitive> instead of the actual variable value in outputs?

Terraform masks variables marked sensitive to prevent accidental exposure in CLI or logs, as shown in execution_table rows 3 and 6.

Is the sensitive variable value stored in the Terraform state file?

Yes, but it is stored securely to protect secrets, as explained in execution_table row 4.

Can you disable the sensitive flag to see the variable value in outputs?

If you remove sensitive=true, Terraform will show the value, but this risks exposing secrets. Keeping sensitive=true ensures safety, as shown in rows 6 and 7.

Visual Quiz - 3 Questions

Look at the execution_table at step 3. What does Terraform show when outputting a sensitive variable?

A <sensitive>

B The actual secret value

C An error message

D Null

💡 Hint

Check the Output Behavior column at step 3 in the execution_table.

At which step does Terraform store the sensitive variable securely in the state file?

A Step 2

B Step 6

C Step 4

D Step 8

💡 Hint

Look for the note about state file storage in the execution_table.

If you remove sensitive=true from the variable definition, what changes in the execution_table output behavior?

A Terraform still hides the value

B Terraform shows the actual value in outputs

C Terraform throws an error

D Terraform skips the variable

💡 Hint

Refer to key_moments about disabling sensitive flag and output visibility.

Concept Snapshot

Terraform sensitive variables:
- Define with sensitive = true
- Values hidden in CLI outputs and logs
- Stored securely in state file
- Protect secrets from accidental exposure
- Outputs show <sensitive> placeholder
- Use for passwords, keys, tokens

Full Transcript

This visual execution shows how Terraform handles sensitive variables. First, you define a variable with sensitive = true. Terraform then marks this variable as sensitive and hides its value during plan and apply steps. When used in outputs or resources, Terraform replaces the actual value with <sensitive> to avoid exposing secrets in CLI or logs. The sensitive value is stored securely in the Terraform state file, protecting it from unauthorized access. Even if you try to print the output without marking it sensitive, Terraform will still mask the value. Removing the sensitive flag will expose the value but risks security. This process ensures your secrets like passwords or API keys stay safe during infrastructure deployment.

Practice

1.

What is the main purpose of marking a variable as sensitive in Terraform?

easy

A. To hide the variable's value from Terraform plan and apply outputs

B. To make the variable read-only

C. To encrypt the variable in the state file automatically

D. To allow the variable to be used only in modules

Solution

1. Step 1: Understand what sensitive means in Terraform

   Marking a variable as sensitive tells Terraform not to show its value in command outputs like plan or apply, protecting secrets from accidental exposure.

2. Step 2: Clarify what sensitive does not do automatically

   Sensitive does not make the variable read-only, nor does it encrypt the state file automatically. It only hides the value in outputs.

3. Final Answer:

   To hide the variable's value from Terraform plan and apply outputs -> Option A

4. Quick Check:

   Sensitive hides values in outputs = B [OK]

Hint: Sensitive hides secrets in outputs, not encryption [OK]

Common Mistakes:

• Thinking sensitive encrypts the state file
• Confusing sensitive with read-only variables
• Believing sensitive restricts variable usage

2.

Which of the following is the correct way to declare a sensitive variable in Terraform?

variable "db_password" {
  type = string
  sensitive = true
}

easy

A. variable "db_password" { sensitive = true; type = string }

B. variable "db_password" { type = string sensitive = true }

C. variable "db_password" { type = string; sensitive = true }

D. variable "db_password" { sensitive: true type: string }

Solution

1. Step 1: Recall Terraform variable block syntax

   Terraform uses HCL syntax where attributes are set with key = value pairs separated by new lines or spaces.

2. Step 2: Identify correct attribute order and syntax

   Attributes order does not matter, but semicolons or colons are invalid in HCL. So sensitive = true and type = string with equals signs and no semicolons is correct.

3. Final Answer:

   variable "db_password" { type = string sensitive = true } -> Option B

4. Quick Check:

   Correct HCL syntax uses equals and no semicolons = A [OK]

Hint: Use equals signs and no semicolons in Terraform blocks [OK]

Common Mistakes:

• Using semicolons or colons instead of equals
• Putting attributes on the same line without proper syntax
• Incorrect attribute order causing confusion

3.

Given this Terraform code snippet, what will be the output of terraform apply regarding the db_password variable?

variable "db_password" {
  type = string
  sensitive = true
}

output "password_output" {
  value = var.db_password
  sensitive = true
}

medium

A. The password value will be hidden in the output after apply

B. The password value will be shown in the output after apply

C. Terraform will throw a syntax error due to sensitive output

D. The password value will be printed in the plan but hidden in apply

Solution

1. Step 1: Understand sensitive variable and output behavior

   Marking a variable and output as sensitive hides their values from Terraform CLI outputs during plan and apply.

2. Step 2: Check if syntax allows sensitive outputs

   Terraform supports marking outputs as sensitive to prevent showing secret values. No syntax error occurs.

3. Final Answer:

   The password value will be hidden in the output after apply -> Option A

4. Quick Check:

   Sensitive outputs hide values in apply output = A [OK]

Hint: Sensitive outputs hide values in apply output [OK]

Common Mistakes:

• Expecting sensitive values to show in outputs
• Thinking sensitive outputs cause syntax errors
• Confusing plan output with apply output

4.

What is wrong with this Terraform variable declaration if the goal is to keep the value secret?

variable "api_key" {
  type = string
  default = "mysecret"
}

medium

A. Default values cannot be used with sensitive variables

B. The variable type should be secret instead of string

C. The variable is missing sensitive = true to hide the value

D. The variable name must start with secret_

Solution

1. Step 1: Check if variable is marked sensitive

   The variable is not marked with sensitive = true, so its value will be shown in outputs and state.

2. Step 2: Validate other options

   Terraform does not have a secret type, default values are allowed, and variable names have no required prefix.

3. Final Answer:

   The variable is missing sensitive = true to hide the value -> Option C

4. Quick Check:

   Missing sensitive attribute means value not hidden = C [OK]

Hint: Add sensitive = true to hide secret values [OK]

Common Mistakes:

• Assuming type secret exists
• Thinking default values are forbidden for secrets
• Believing variable names must have secret prefix

5.

You want to pass a sensitive database password from a Terraform module to the root module without exposing it in any output or logs. Which approach is best?

hard

A. Use a non-sensitive variable and rely on Terraform state encryption

B. Pass the password as a normal variable and print it in the root output for verification

C. Store the password in a plain text file and read it in both modules

D. Mark the variable as sensitive in the module and mark the output as sensitive in the module and root

Solution

1. Step 1: Protect sensitive data in modules

   Marking variables and outputs as sensitive in both the module and root prevents accidental exposure in CLI outputs and logs.

2. Step 2: Avoid insecure practices

   Printing secrets in outputs, storing in plain text files, or relying only on state encryption risks exposure.

3. Final Answer:

   Mark the variable as sensitive in the module and mark the output as sensitive in the module and root -> Option D

4. Quick Check:

   Mark sensitive in variables and outputs to keep secrets safe = D [OK]

Hint: Mark sensitive on variables and outputs in all modules [OK]

Common Mistakes:

• Printing secrets in outputs for debugging
• Storing secrets in plain text files
• Assuming state encryption alone is enough