A Terraform output that sets the ''sensitive'' argument to true will not store that value in the state file.

The correct answer is B. False. Setting the 'sensitive' argument to true for a Terraform output only prevents its display in CLI output, but the value is still stored unencrypted in the state file.

Use the Terraform CLI (terraform plan, apply, destroy, fmt, init, validate, workspace, import, taint, providers, output)

Question

Options

ATrue
BFalse

How the community answered

(45 responses)

A
9% (4)
B
91% (41)

Why each option

Setting the 'sensitive' argument to true for a Terraform output only prevents its display in CLI output, but the value is still stored unencrypted in the state file.

ATrue

This statement is false because the sensitive argument specifically targets CLI output masking, not storage within the state file.

BFalseCorrect

The sensitive = true argument on a Terraform output variable only masks the value from being printed to standard output when terraform plan or terraform apply is run. This setting does not prevent the sensitive value from being stored within the Terraform state file, which can still contain the unencrypted secret.

Concept tested: Terraform output sensitive argument behavior

Source: https://developer.hashicorp.com/terraform/language/values/outputs#sensitive-outputs

Topics

#Terraform outputs#Sensitive data#State file#CLI behavior

Community Discussion

No community discussion yet for this question.

Full TA-002-P Practice