TA-002-P · Question #388
Your firm employs a version control system (for example, git) and has requested that you commit all terraform code to it. During the commit, you must be cautious with sensitive information. Which of…
The correct answer is D. terraform.tfstate. The terraform.tfstate file should be excluded from version control because it often contains sensitive data and represents the current infrastructure state, which is best managed by Terraform's remote backends.
Question
Your firm employs a version control system (for example, git) and has requested that you commit all terraform code to it. During the commit, you must be cautious with sensitive information. Which of the following files should be left out of the commit?
Options
- Amain.tf
- Bvariables.tf
- Cprovisioner.tf
- Dterraform.tfstate
How the community answered
(37 responses)- A3% (1)
- B5% (2)
- D92% (34)
Why each option
The `terraform.tfstate` file should be excluded from version control because it often contains sensitive data and represents the current infrastructure state, which is best managed by Terraform's remote backends.
main.tf is a core Terraform configuration file and should always be committed to version control.
variables.tf defines input variables for Terraform configurations and should always be committed to version control.
provisioner.tf (or any .tf file defining resources or provisioners) is part of the Terraform code and should always be committed to version control.
The terraform.tfstate file contains the actual state of your deployed infrastructure, which often includes sensitive data like secrets or resource IDs, and should never be committed to a version control system like Git. Instead, it should be managed by a remote backend or be excluded from version control via .gitignore.
Concept tested: Terraform state file security
Source: https://developer.hashicorp.com/terraform/language/state/sensitive-data
Topics
Community Discussion
No community discussion yet for this question.