nerdexam
HashiCorp

TA-002-P · Question #369

Why should secrets not be hard coded into Terraform code? Choose two correct answers

The correct answer is B. The Terraform code is copied to the target resources to be applied locally and could expose C. Terraform code is typically stored in version control, as well as copied to the systems from h it's. Hardcoding secrets in Terraform is dangerous because the code, including sensitive information, is typically stored in version control and distributed to systems that apply it, risking exposure.

Understand infrastructure as code (IaC) concepts

Question

Why should secrets not be hard coded into Terraform code? Choose two correct answers

Options

  • AAll passwords should be rotated on a quarterly basis.
  • BThe Terraform code is copied to the target resources to be applied locally and could expose
  • CTerraform code is typically stored in version control, as well as copied to the systems from h it's
  • DIt makes the code less reusable.

How the community answered

(21 responses)
  • A
    5% (1)
  • B
    90% (19)
  • D
    5% (1)

Why each option

Hardcoding secrets in Terraform is dangerous because the code, including sensitive information, is typically stored in version control and distributed to systems that apply it, risking exposure.

AAll passwords should be rotated on a quarterly basis.

While password rotation is a security best practice, it's not the primary reason why secrets shouldn't be hardcoded into the code itself; it's a separate operational security measure.

BThe Terraform code is copied to the target resources to be applied locally and could exposeCorrect

Terraform code, when applied, is often copied or executed on target systems, and if secrets are hardcoded, they could be exposed on these systems or during the application process.

CTerraform code is typically stored in version control, as well as copied to the systems from h it'sCorrect

Terraform code is commonly stored in version control systems like Git, which retain historical versions, making hardcoded secrets permanently accessible to anyone with repository access and increasing the risk of compromise.

DIt makes the code less reusable.

Hardcoding secrets does not inherently make code less reusable; rather, it primarily poses a security risk by embedding sensitive data directly.

Concept tested: Terraform security best practices for secrets

Source: https://developer.hashicorp.com/terraform/language/values/variables#sensitive-variables

Topics

#Secrets management#Security best practices#Version control#Hardcoding

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full TA-002-P Practice