Sensitive variable handling in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why mark a variable as sensitive in Terraform?

You have a Terraform variable that stores a database password. Why should you mark this variable as sensitive?

A To prevent the password from being shown in Terraform plan and apply outputs.

B To encrypt the password in the Terraform state file automatically.

C To allow the password to be shared publicly without risk.

D To make the password variable optional in the configuration.

💡 Hint

Think about what happens when Terraform shows outputs during deployment.

Marking a variable as sensitive hides its value in Terraform plan and apply outputs to avoid accidental exposure. It does not encrypt the state file or make the variable optional.

❓ Configuration

intermediate

Terraform variable declaration with sensitivity

Which Terraform variable declaration correctly marks the variable as sensitive?

A

variable "db_password" {
  type      = string
  secret    = true
}

B

variable "db_password" {
  type      = string
  sensitive = true
}

C

variable "db_password" {
  type      = string
  hidden    = true
}

D

variable "db_password" {
  type      = string
  secure    = true
}

💡 Hint

Check the exact attribute name Terraform uses for sensitive variables.

Terraform uses the attribute 'sensitive = true' to mark variables as sensitive. Other attribute names are invalid and cause errors.

❓ Architecture

advanced

Best practice for storing sensitive variables in Terraform

You want to keep your sensitive variables secure and avoid committing them to version control. Which approach is best?

A Commit sensitive variables encrypted with base64 encoding to version control.

B Hardcode sensitive variables directly in the main Terraform configuration files.

C Store sensitive variables in a separate file ignored by version control and load it with -var-file option.

D Store sensitive variables as plain text environment variables and reference them in Terraform.

💡 Hint

Think about how to keep secrets out of version control safely.

Storing sensitive variables in a separate file ignored by version control and loading it at runtime keeps secrets safe. Hardcoding or committing them even encoded risks exposure.

❓ service_behavior

advanced

Terraform output behavior with sensitive variables

You define an output in Terraform that references a sensitive variable. What will Terraform show when you run 'terraform output'?

A Terraform will hide the output value and show (sensitive) instead.

B Terraform will display the output value but mask half of the characters.

C Terraform will cause an error and refuse to show any output.

D Terraform will display the full sensitive value in plain text.

💡 Hint

Consider how Terraform protects sensitive outputs from accidental exposure.

Terraform hides sensitive output values by showing (sensitive) to prevent secrets from being exposed in the CLI output.

❓ security

expert

Terraform state file and sensitive data exposure

Which statement about sensitive variables and the Terraform state file is true?

A Terraform automatically encrypts sensitive variables inside the state file by default.

B Sensitive variables are never stored in the state file to protect secrets.

C Terraform stores sensitive variables in a separate encrypted state file automatically.

D Sensitive variables are stored in plain text in the state file unless additional encryption is applied.

💡 Hint

Think about what Terraform does by default with state files and sensitive data.

Terraform stores all variable values, including sensitive ones, in the state file in plain text unless you configure encryption or use a secure backend.