Sensitive variable handling in Terraform - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a sensitive variable in Terraform?

A sensitive variable is a variable that contains confidential information, such as passwords or API keys, which Terraform hides in its output to protect the data.

beginner

How do you declare a sensitive variable in Terraform?

You declare a sensitive variable by adding the attribute sensitive = true in the variable block.

intermediate

Why should you mark variables as sensitive in Terraform?

Marking variables as sensitive prevents Terraform from showing their values in logs and plan output, reducing the risk of exposing secrets. However, sensitive values are still stored in the state file in plain text.

intermediate

Can sensitive variables be used in Terraform outputs?

Yes, but you must mark the output as sensitive too. Otherwise, Terraform will warn you and may expose the value.

beginner

What happens if you do not mark a secret as sensitive in Terraform?

The secret may appear in Terraform plan, apply logs, or state files, risking accidental exposure to anyone with access to those files.

How do you mark a variable as sensitive in Terraform?

A Add <code>sensitive = true</code> in the variable block

B Prefix the variable name with 'secret_'

C Use <code>private = true</code> in the variable block

D Encrypt the variable value manually

You mark a variable as sensitive by adding sensitive = true in its declaration block.

What does Terraform do with sensitive variables during plan and apply?

A Hides their values in output and logs

B Prints their values in plain text

C Deletes the variables after use

D Saves them in a separate file

Terraform hides sensitive variable values in plan and apply outputs to protect secrets.

If you output a sensitive variable without marking the output as sensitive, what happens?

A Terraform automatically hides the output

B Terraform warns and may expose the value

C Terraform blocks the deployment

D Terraform encrypts the output

Terraform warns you and may expose the sensitive value if the output is not marked sensitive.

Why is it important to mark variables as sensitive?

A To enable variable reuse

B To speed up Terraform runs

C To reduce variable size

D To prevent accidental exposure of secrets in logs and state files

Marking variables sensitive protects secrets from being shown in logs and state files.

Which of the following is NOT a best practice for handling sensitive variables in Terraform?

A Mark variables as sensitive

B Use environment variables or secret managers

C Store secrets in version control in plain text

D Mark outputs as sensitive when they expose secrets

Storing secrets in plain text in version control is unsafe and not recommended.

Explain how to declare and use sensitive variables in Terraform and why it matters.

Think about how Terraform treats secrets differently to keep them safe.

Describe the risks of not marking sensitive variables properly in Terraform.

Consider what happens if anyone can see your Terraform logs or state files.