Which option cannot be used to keep secrets out of Terraform configuration files?

The correct answer is D. secure string. Terraform provides several legitimate mechanisms for supplying secrets without hardcoding them in .tf files: environment variables prefixed with TF_VAR_ (option B), the -var flag at the command line (option C), and Terraform providers such as HashiCorp Vault (option A) that…

Submitted by priya_blr· Apr 18, 2026Work with Terraform Configurations

Question

Which option cannot be used to keep secrets out of Terraform configuration files?

Options

AA Terraform provider
BEnvironment variables
CA -var flag
Dsecure string

How the community answered

(64 responses)

A
2% (1)
B
2% (1)
C
3% (2)
D
94% (60)

Explanation

Terraform provides several legitimate mechanisms for supplying secrets without hardcoding them in .tf files: environment variables prefixed with TF_VAR_ (option B), the -var flag at the command line (option C), and Terraform providers such as HashiCorp Vault (option A) that retrieve secrets dynamically at runtime. 'secure string' is not a Terraform construct - it is a concept from AWS SSM Parameter Store. There is no built-in Terraform feature called 'secure string', making it the invalid option for secret management in Terraform.

Topics

#Secrets management#Input variables#Security best practices#Providers

Community Discussion

No community discussion yet for this question.

Full TERRAFORM-ASSOCIATE-004 Practice