You're building a CI/CD (continuous integration/ continuous delivery) pipeline and need to inject sensitive variables into your Terraform run. How can you do this safely?

Passing variables with a `-var` flag directly on the command line is generally insecure for sensitive data, as values can be exposed in shell history, process lists, or logs.

By "copying sensitive variables into your Terraform code," the question implies leveraging Terraform's ability to fetch sensitive data from external, secure secrets management services (like HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager) using data sources. This method embeds references to secrets in the HCL code, allowing Terraform to retrieve the actual sensitive values at runtime without ever storing them in plaintext within the configuration files or version control.

Storing sensitive variables in a `secure_vars.tf` file is insecure if the file is committed to version control in plaintext, as `.tf` files are typically part of the configuration repository.

Storing sensitive variables as plain text in a source code repository is a fundamental security anti-pattern and highly insecure, exposing secrets to anyone with access to the repository.