Sensitive variable handling in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why mark a variable as sensitive in Terraform?

You have a Terraform variable that stores a database password. Why should you mark this variable as sensitive?

A To prevent the password from being shown in Terraform plan and apply outputs.

B To encrypt the password in the Terraform state file automatically.

C To allow the password to be shared publicly without risk.

D To make the password variable optional in the configuration.

💡 Hint

Think about what happens when Terraform shows outputs during deployment.

Marking a variable as sensitive hides its value in Terraform plan and apply outputs to avoid accidental exposure. It does not encrypt the state file or make the variable optional.

❓ Configuration

intermediate

Terraform variable declaration with sensitivity

Which Terraform variable declaration correctly marks the variable as sensitive?

A

variable "db_password" {
  type      = string
  secret    = true
}

B

variable "db_password" {
  type      = string
  sensitive = true
}

C

variable "db_password" {
  type      = string
  hidden    = true
}

D

variable "db_password" {
  type      = string
  secure    = true
}

💡 Hint

Check the exact attribute name Terraform uses for sensitive variables.

Terraform uses the attribute 'sensitive = true' to mark variables as sensitive. Other attribute names are invalid and cause errors.

❓ Architecture

advanced

Best practice for storing sensitive variables in Terraform

You want to keep your sensitive variables secure and avoid committing them to version control. Which approach is best?

A Commit sensitive variables encrypted with base64 encoding to version control.

B Hardcode sensitive variables directly in the main Terraform configuration files.

C Store sensitive variables in a separate file ignored by version control and load it with -var-file option.

D Store sensitive variables as plain text environment variables and reference them in Terraform.

💡 Hint

Think about how to keep secrets out of version control safely.

Storing sensitive variables in a separate file ignored by version control and loading it at runtime keeps secrets safe. Hardcoding or committing them even encoded risks exposure.

❓ service_behavior

advanced

Terraform output behavior with sensitive variables

You define an output in Terraform that references a sensitive variable. What will Terraform show when you run 'terraform output'?

A Terraform will hide the output value and show (sensitive) instead.

B Terraform will display the output value but mask half of the characters.

C Terraform will cause an error and refuse to show any output.

D Terraform will display the full sensitive value in plain text.

💡 Hint

Consider how Terraform protects sensitive outputs from accidental exposure.

Terraform hides sensitive output values by showing (sensitive) to prevent secrets from being exposed in the CLI output.

❓ security

expert

Terraform state file and sensitive data exposure

Which statement about sensitive variables and the Terraform state file is true?

A Terraform automatically encrypts sensitive variables inside the state file by default.

B Sensitive variables are never stored in the state file to protect secrets.

C Terraform stores sensitive variables in a separate encrypted state file automatically.

D Sensitive variables are stored in plain text in the state file unless additional encryption is applied.

💡 Hint

Think about what Terraform does by default with state files and sensitive data.

Terraform stores all variable values, including sensitive ones, in the state file in plain text unless you configure encryption or use a secure backend.

Practice

1. What does setting sensitive = true on a Terraform variable do?

easy

A. It hides the variable's value in Terraform plan and apply outputs.

B. It encrypts the variable value in the Terraform state file.

C. It makes the variable read-only in the configuration.

D. It automatically rotates the variable value periodically.

Solution

1. Step 1: Understand the purpose of sensitive attribute

   The sensitive = true flag tells Terraform to hide the variable's value in output logs and plans to avoid accidental exposure.

2. Step 2: Clarify what it does not do

   It does not encrypt the state file or rotate values; those are separate concerns.

3. Final Answer:

   It hides the variable's value in Terraform plan and apply outputs. -> Option A

4. Quick Check:

   sensitive = true hides output values [OK]

Hint: Sensitive true hides values in output, not encryption [OK]

Common Mistakes:

• Thinking sensitive encrypts the state file
• Assuming sensitive makes variables read-only
• Believing sensitive rotates secrets automatically

2. Which of the following is the correct syntax to declare a sensitive variable in Terraform?

easy

A. variable "db_password" { type = string sensitive = true }

B. variable "db_password" { type = string
sensitive = true }

C. variable "db_password" { type = string, sensitive = true }

D. variable "db_password" { type = string; sensitive = true }

Solution

1. Step 1: Recall Terraform block syntax

   Terraform uses HCL syntax where attributes inside blocks are separated by new lines without commas or semicolons.

2. Step 2: Identify correct formatting

   variable "db_password" { type = string sensitive = true } correctly places sensitive = true on a new line without commas or semicolons.

3. Final Answer:

   variable "db_password" { type = string sensitive = true } -> Option B

4. Quick Check:

   HCL uses new lines, no commas or semicolons [OK]

Hint: Use new lines, no commas or semicolons in variable blocks [OK]

Common Mistakes:

• Adding commas between attributes
• Using semicolons inside blocks
• Putting attributes on the same line without proper syntax

3. Given this Terraform output block:

output "db_password" {
  value     = var.db_password
  sensitive = true
}

What will Terraform display when you run terraform output?

medium

A. It will show (sensitive) instead of the password.

B. It will cause an error because outputs cannot be sensitive.

C. It will show the actual password value.

D. It will show an empty string.

Solution

1. Step 1: Understand sensitive outputs behavior

   When an output is marked sensitive, Terraform hides its value in the output command to avoid exposing secrets.

2. Step 2: Confirm expected output

   Terraform replaces the actual value with (sensitive) text instead of showing the secret.

3. Final Answer:

   It will show (sensitive) instead of the password. -> Option A

4. Quick Check:

   sensitive output hides value with (sensitive) [OK]

Hint: Sensitive outputs show (sensitive), not actual values [OK]

Common Mistakes:

• Expecting actual secret to print
• Thinking sensitive outputs cause errors
• Assuming output is empty string

4. You have marked a variable as sensitive = true but when running terraform plan, the secret value still appears. What is the most likely cause?

medium

A. You forgot to run terraform apply first.

B. Terraform does not support sensitive variables in plans.

C. The variable is used directly in a resource argument that prints its value.

D. The variable type is not set to string.

Solution

1. Step 1: Understand sensitive variable behavior in plans

   Terraform hides sensitive variable values in outputs but if the variable is interpolated directly into resource arguments that display in plan, the value can appear.

2. Step 2: Identify cause of exposure

   Using sensitive variables in resource arguments that Terraform shows in plan can reveal the secret despite the sensitive flag.

3. Final Answer:

   The variable is used directly in a resource argument that prints its value. -> Option C

4. Quick Check:

   Direct use in resource can expose sensitive values [OK]

Hint: Sensitive hides output but not direct resource interpolation [OK]

Common Mistakes:

• Assuming sensitive hides all plan values
• Thinking apply is needed to hide values
• Believing variable type affects sensitivity

5. You want to securely store a database password in Terraform and avoid exposing it in state files or outputs. Which combination of practices is best?

hard

A. Use sensitive = false and rely on Terraform's default security.

B. Mark the variable as sensitive = true and print it in outputs for verification.

C. Store the password in plain text variable and restrict access to the Terraform config files.

D. Mark the variable as sensitive = true, use sensitive outputs, and encrypt the Terraform state file.

Solution

1. Step 1: Protect variable visibility

   Marking the variable as sensitive hides it in outputs and plans, reducing accidental exposure.

2. Step 2: Secure outputs and state file

   Using sensitive outputs keeps secrets hidden when showing results, and encrypting the state file protects stored secrets.

3. Final Answer:

   Mark the variable as sensitive = true, use sensitive outputs, and encrypt the Terraform state file. -> Option D

4. Quick Check:

   Combine sensitive flag, outputs, and state encryption [OK]

Hint: Combine sensitive flag, outputs, and state encryption [OK]

Common Mistakes:

• Printing sensitive variables in outputs
• Storing secrets in plain text variables
• Relying on defaults without encryption