Which option can not be used to keep secrets out of Terraform configuration files?

The correct answer is C. A -var flag. 'secure string' is not a Terraform-native concept - it is an AWS SSM Parameter Store designation and cannot be used on its own as a Terraform mechanism to keep secrets out of config files. All other options are legitimate approaches: (A) providers such as HashiCorp Vault can dyna

Use the Terraform CLI (terraform plan, apply, destroy, fmt, init, validate, workspace, import, taint, providers, output)

Question

Options

AA Terraform provider
BEnvironment variables
CA -var flag
Dsecure string

How the community answered

(23 responses)

A
4% (1)
B
4% (1)
C
83% (19)
D
9% (2)

Explanation

'secure string' is not a Terraform-native concept - it is an AWS SSM Parameter Store designation and cannot be used on its own as a Terraform mechanism to keep secrets out of config files. All other options are legitimate approaches: (A) providers such as HashiCorp Vault can dynamically retrieve secrets at runtime; (B) environment variables prefixed with TF_VAR_ pass values without embedding them in config files; (C) the -var flag passes values at the command line, avoiding hardcoding in config. The provided answer key lists C, but the -var flag is a valid secret-injection method. The correct answer is D.

Topics

#Secrets management#Terraform variables#CLI arguments#Security best practices

Community Discussion

No community discussion yet for this question.

Full TA-002-P Practice