TA-002-P · Question #417
Which provider authentication method prevents credentials from being stored in the state file?
The correct answer is A. Using environment variables. Using environment variables for provider credentials is the only method listed that keeps secrets out of Terraform state, plan files, and configuration files entirely.
Question
Which provider authentication method prevents credentials from being stored in the state file?
Options
- AUsing environment variables
- BSpecifying the login credentials in the provider block
- CSetting credentials as Terraform variables
- DNone of the above
How the community answered
(37 responses)- A92% (34)
- B3% (1)
- C5% (2)
Why each option
Using environment variables for provider credentials is the only method listed that keeps secrets out of Terraform state, plan files, and configuration files entirely.
Environment variables are read by the provider SDK at runtime and are never written to the Terraform state file or plan output. This keeps credentials in the process environment only, satisfying the principle of least exposure for secrets.
Credentials specified directly in the provider block are stored in plain text in .tf files and can appear in state or plan output, violating security best practices.
Terraform variables can be passed via tfvars files or CLI flags, but their values may appear in the state file or plan output depending on whether they are marked sensitive, and they are still written to Terraform internals.
None of the above is incorrect because environment variables do prevent credentials from being stored in the state file.
Concept tested: Secure provider authentication using environment variables
Source: https://developer.hashicorp.com/terraform/language/providers/configuration#provider-configuration
Topics
Community Discussion
No community discussion yet for this question.