Sensitive information includes passwords, tokens, API keys, and other configuration or state whose disclosure could compromise an application or deployment. Keep it out of source code and treat displayed output as a security boundary. section 12.5.2 section 2.6.6
Terraform marks sensitive outputs explicitly and replaces them with <sensitive> in normal terminal output. This protects deployment logs, but the value can still exist in plain text in terraform.tfstate. section 7.9.4
Use a deliberate storage and delivery path:
- Pass runtime secrets through environment variables rather than embedding them in application code. section 2.6.6
- Store deployment credentials in GitHub Secrets or an equivalent continuous-deployment provider. section 12.5.2
- Use Kubernetes Secrets or an independent secrets product such as Vault when provider-managed storage is unsuitable. section 12.5.2
- Avoid production outputs for sensitive values; outputs may help debugging but are unnecessary for ordinary resource creation. section 7.9.5
Retrieving a Terraform registry password
A declared sensitive Terraform output appears as <sensitive> in routine output. Running terraform output -raw registry_pw reveals the actual password, which can then be used to authenticate Docker to the container registry. This deliberate retrieval also exposes the credential in the terminal, so it should be reserved for controlled learning or operational need. section 7.9.4 section 7.9.5
terraform output -raw registry_pw
Run the supplied Terraform command to retrieve a named sensitive output; handle the resulting terminal value as exposed secret material. section 7.9.4
