TA-002-P · Question #413
Why does this backend configuration not follow best practices?
The correct answer is A. You should not store credentials in Terraform Configuration. Storing credentials directly in a Terraform backend configuration block is a security anti-pattern because those values can be committed to version control or exposed in plan output.
Question
Why does this backend configuration not follow best practices?
Options
- AYou should not store credentials in Terraform Configuration
- BYou should use the local enhanced storage backend whenever possible
- CAn alias meta-argument should be included in backend blocks whenever possible
- DThe backend configuration should contain multiple credentials so that more than one user can
How the community answered
(33 responses)- A94% (31)
- C3% (1)
- D3% (1)
Why each option
Storing credentials directly in a Terraform backend configuration block is a security anti-pattern because those values can be committed to version control or exposed in plan output.
Hardcoding credentials in backend blocks risks exposing secrets in version-controlled .tf files and in Terraform output. Best practice is to supply credentials through environment variables or a secrets manager so they are never written to disk as plaintext configuration.
The local backend is not recommended for team use or production; remote backends are preferred, not local ones.
The alias meta-argument is used for provider configurations, not backend blocks, and is not a backend best practice.
Backend configurations are not designed to hold multiple credential sets; access control is managed at the remote backend level, not inside the Terraform config.
Concept tested: Terraform backend credential security best practices
Source: https://developer.hashicorp.com/terraform/language/settings/backends/configuration#credentials-and-sensitive-data
Topics
Community Discussion
No community discussion yet for this question.