Sensitivity is metadata attached to a Terraform value to signal that Terraform should avoid displaying or logging it. Mark passwords, API keys, provider authentication, and similar secrets before they flow through resources, locals, or outputs. section 3.3.2 section 8.5
Listing 3.4 Marking variables as sensitive
variable "logging_api_key" {
description = "The API Key for our logging service."
type = string
sensitive = true #1
}
Declare a variable with sensitive = true so Terraform masks the value as it is passed into resources or used to calculate locals. section 3.3.2
The flag follows values derived from sensitive values, including strings that embed them. Terraform is conservative, so an otherwise innocuous derived value may also become sensitive. Sensitivity does not encrypt or remove the value from state; secure state storage and access remain essential. section 3.3.2 section 4.6.3
Protecting a generated password
A module that creates a password should expose it through a sensitive output: output "super_secret_password" { value = resource.random_password.id sensitive = true }. Terraform then prevents the command-line interface from displaying the output. The random_password attribute is sensitive by default, and using it still requires careful state management. section 3.4.2 section 6.8.1
Handle sensitivity deliberately when values cross configuration boundaries:
- Mark outputs sensitive when their values come from sensitive inputs; otherwise Terraform can report an accidental exposure. section 3.4.2
- Use sensitive(value) to return an equivalent value with the sensitivity flag, rather than changing an existing variable. section 4.6.3
- Use nonsensitive(value) only after reviewing and documenting why exposing the resulting value will not leak information. section 4.6.3
- Keep credentials out of Git and protect Terraform state because sensitivity prevents routine display but does not prevent state storage. section 3.3.2 section 8.5
Listing 4.31 Sensitive and nonsensitive
resource "random_uuid" "visible_uuid" { #1
#2
}
locals {
sensitive_uuid = sensitive(random_uuid.visible_uuid.result) #3
}
Compare sensitive(random_uuid.visible_uuid.result) with the original value to see how Terraform returns a new value carrying the sensitivity flag. section 4.6.3
