Sensitive variable handling in Terraform - Step-by-Step Execution

Process Flow - Sensitive variable handling

Define variable with sensitive=true

↓

Terraform hides value in output

↓

Use variable in resource config

↓

Terraform applies config securely

↓

Sensitive value not shown in logs or plan

↓

Output or state file stores encrypted or masked value

Terraform marks variables as sensitive to hide their values in outputs and logs, ensuring secrets are not exposed during deployment.

Execution Sample

Terraform

variable "db_password" {
  type      = string
  sensitive = true
}

resource "aws_db_instance" "example" {
  password = var.db_password
}

Defines a sensitive variable for a database password and uses it in a resource without exposing the value.

Process Table

Step	Action	Variable State	Output Visibility	Result
1	Define variable db_password with sensitive=true	db_password = <sensitive>	Hidden	Variable marked sensitive
2	Terraform plan reads variable	db_password = <sensitive>	Hidden	Value masked in plan output
3	Apply resource using db_password	db_password = <sensitive>	Hidden	Password used securely in resource
4	Terraform output or logs	db_password = <sensitive>	Hidden	No sensitive value shown
5	State file stores sensitive value	db_password = <sensitive>	Not visible	Value stored securely

💡 Sensitive variable remains hidden throughout plan, apply, and output phases to protect secrets.

Status Tracker

Variable	Start	After Plan	After Apply	Final
db_password	<sensitive>	<sensitive>	<sensitive>	<sensitive>

Key Moments - 3 Insights

Why can't I see the value of a sensitive variable in the Terraform plan output?

Terraform masks sensitive variables in the plan output to prevent accidental exposure, as shown in execution_table step 2.

Is the sensitive variable value stored in plain text in the state file?

No, the state file stores sensitive values encrypted or masked, ensuring security as shown in execution_table step 5.

Can I output a sensitive variable value directly in Terraform outputs?

Terraform hides sensitive outputs by default to protect secrets, so sensitive variables won't show their values in outputs, as in step 4.

Visual Quiz - 3 Questions

Look at the execution table, at which step is the sensitive variable value first hidden from output?

A Step 2

B Step 3

C Step 1

D Step 4

💡 Hint

Check the 'Output Visibility' column in execution_table rows.

According to the variable tracker, what is the state of db_password after apply?

A <visible>

B <encrypted>

C <sensitive>

D <null>

💡 Hint

Look at the 'After Apply' column for db_password in variable_tracker.

If sensitive was set to false, how would the plan output change?

A Value would remain hidden

B Value would be visible in plan output

C Terraform would error

D Value would be encrypted in plan

💡 Hint

Refer to the behavior described in execution_table step 2 about output visibility.

Concept Snapshot

Terraform sensitive variables:
- Mark with sensitive = true
- Values hidden in plan, apply, and outputs
- Protect secrets from accidental exposure
- State file stores encrypted or masked
- Use sensitive vars for passwords, keys, tokens

Full Transcript

This visual execution shows how Terraform handles sensitive variables. First, you define a variable with sensitive=true. Terraform then hides this value in plan outputs and logs to protect secrets. When applying resources, the sensitive value is used securely but never shown. Outputs also mask sensitive values. Finally, the state file stores these values encrypted or masked to keep them safe. This prevents accidental exposure of passwords or keys during deployment.

Practice

1. What does setting sensitive = true on a Terraform variable do?

easy

A. It hides the variable's value in Terraform plan and apply outputs.

B. It encrypts the variable value in the Terraform state file.

C. It makes the variable read-only in the configuration.

D. It automatically rotates the variable value periodically.

Solution

1. Step 1: Understand the purpose of sensitive attribute

   The sensitive = true flag tells Terraform to hide the variable's value in output logs and plans to avoid accidental exposure.

2. Step 2: Clarify what it does not do

   It does not encrypt the state file or rotate values; those are separate concerns.

3. Final Answer:

   It hides the variable's value in Terraform plan and apply outputs. -> Option A

4. Quick Check:

   sensitive = true hides output values [OK]

Hint: Sensitive true hides values in output, not encryption [OK]

Common Mistakes:

• Thinking sensitive encrypts the state file
• Assuming sensitive makes variables read-only
• Believing sensitive rotates secrets automatically

2. Which of the following is the correct syntax to declare a sensitive variable in Terraform?

easy

A. variable "db_password" { type = string sensitive = true }

B. variable "db_password" { type = string
sensitive = true }

C. variable "db_password" { type = string, sensitive = true }

D. variable "db_password" { type = string; sensitive = true }

Solution

1. Step 1: Recall Terraform block syntax

   Terraform uses HCL syntax where attributes inside blocks are separated by new lines without commas or semicolons.

2. Step 2: Identify correct formatting

   variable "db_password" { type = string sensitive = true } correctly places sensitive = true on a new line without commas or semicolons.

3. Final Answer:

   variable "db_password" { type = string sensitive = true } -> Option B

4. Quick Check:

   HCL uses new lines, no commas or semicolons [OK]

Hint: Use new lines, no commas or semicolons in variable blocks [OK]

Common Mistakes:

• Adding commas between attributes
• Using semicolons inside blocks
• Putting attributes on the same line without proper syntax

3. Given this Terraform output block:

output "db_password" {
  value     = var.db_password
  sensitive = true
}

What will Terraform display when you run terraform output?

medium

A. It will show (sensitive) instead of the password.

B. It will cause an error because outputs cannot be sensitive.

C. It will show the actual password value.

D. It will show an empty string.

Solution

1. Step 1: Understand sensitive outputs behavior

   When an output is marked sensitive, Terraform hides its value in the output command to avoid exposing secrets.

2. Step 2: Confirm expected output

   Terraform replaces the actual value with (sensitive) text instead of showing the secret.

3. Final Answer:

   It will show (sensitive) instead of the password. -> Option A

4. Quick Check:

   sensitive output hides value with (sensitive) [OK]

Hint: Sensitive outputs show (sensitive), not actual values [OK]

Common Mistakes:

• Expecting actual secret to print
• Thinking sensitive outputs cause errors
• Assuming output is empty string

4. You have marked a variable as sensitive = true but when running terraform plan, the secret value still appears. What is the most likely cause?

medium

A. You forgot to run terraform apply first.

B. Terraform does not support sensitive variables in plans.

C. The variable is used directly in a resource argument that prints its value.

D. The variable type is not set to string.

Solution

1. Step 1: Understand sensitive variable behavior in plans

   Terraform hides sensitive variable values in outputs but if the variable is interpolated directly into resource arguments that display in plan, the value can appear.

2. Step 2: Identify cause of exposure

   Using sensitive variables in resource arguments that Terraform shows in plan can reveal the secret despite the sensitive flag.

3. Final Answer:

   The variable is used directly in a resource argument that prints its value. -> Option C

4. Quick Check:

   Direct use in resource can expose sensitive values [OK]

Hint: Sensitive hides output but not direct resource interpolation [OK]

Common Mistakes:

• Assuming sensitive hides all plan values
• Thinking apply is needed to hide values
• Believing variable type affects sensitivity

5. You want to securely store a database password in Terraform and avoid exposing it in state files or outputs. Which combination of practices is best?

hard

A. Use sensitive = false and rely on Terraform's default security.

B. Mark the variable as sensitive = true and print it in outputs for verification.

C. Store the password in plain text variable and restrict access to the Terraform config files.

D. Mark the variable as sensitive = true, use sensitive outputs, and encrypt the Terraform state file.

Solution

1. Step 1: Protect variable visibility

   Marking the variable as sensitive hides it in outputs and plans, reducing accidental exposure.

2. Step 2: Secure outputs and state file

   Using sensitive outputs keeps secrets hidden when showing results, and encrypting the state file protects stored secrets.

3. Final Answer:

   Mark the variable as sensitive = true, use sensitive outputs, and encrypt the Terraform state file. -> Option D

4. Quick Check:

   Combine sensitive flag, outputs, and state encryption [OK]

Hint: Combine sensitive flag, outputs, and state encryption [OK]

Common Mistakes:

• Printing sensitive variables in outputs
• Storing secrets in plain text variables
• Relying on defaults without encryption