Pebellslearn by building
0%
RoadmapsMatrixCoursesSandboxSign in
Outputs  ›  Lesson

Sensitive Outputs

Sensitive Outputs 12 minMarking an output sensitive = true hides its value in plan and apply output, but the value is still stored in plain text in state and can still be read on purpose, so it is a screen, not encryption.

Sensitive Outputs

Crumb now has a database, and its password is generated by Terraform with a random_password resource. You want to output it so the app can use it, but you do not want it printed into every CI log. That is what sensitive outputs are for, and it matters to know exactly how far they go.

The rule

sensitive hides it from the screen, not from the state.

output "db_password" {
  value       = random_password.db.result
  description = "Password for Crumb's orders database"
  sensitive   = true
}

With sensitive = true:

  • plan shows the value as (sensitive value), and the outputs printed after apply show <sensitive>.
  • terraform output with no name lists it as db_password = <sensitive>.

What it does not do:

  • State still stores it in plain text. Anyone who can read the state file can read the password.
  • Asking for it by name reveals it. terraform output db_password, terraform output -raw db_password and terraform output -json all print the real value. That is on purpose: scripts need it.

Sensitivity also spreads. If an output's value comes from something already sensitive, such as a variable marked sensitive = true, Terraform refuses to plan until the output is marked sensitive too:

Error: Output refers to sensitive values

That error is a guard rail, not a bug. Add sensitive = true, or rethink whether the value should be an output at all.

The shortcut

Picture two doors. The screen door (plan, apply, the output list) is closed by sensitive = true. The state door stays open, so it must be locked separately: a remote backend with encryption and restricted access, or better, a secrets manager so the value never needs to leave the cloud.

Handling Crumb's database passwordStep 1 of 4

  1. Mark it

    Add sensitive = true to the db_password output. CI logs now show (sensitive value).

The trap: believing sensitive means encrypted. It is a display filter.

Drills

Answer fast — trust the rule.

quick drill

What does sensitive = true on an output change?

quick drill

Where is a sensitive output's value still readable in plain text?

quick drill

What does terraform output -raw db_password print for a sensitive output?

quick drill

An output's value comes from a sensitive variable, and the output has no sensitive setting. What happens?

Remember

  • sensitive = true hides values from plan, apply and the output list.
  • Shortcut: it closes the screen door; lock the state door separately.
  • Trap: sensitive is not encryption, and naming the output prints it.

Practice — level up

0/1 solved

Write your answer, then compare it with a rubric and a model answer.

ExplainWhat sensitive really does

Crumb adds a database whose generated password must reach the app. A teammate says 'we marked the output sensitive, so the password is safe'. Explain what sensitive = true actually protects, what it does not, and one more step the team should take.