Context
The sensitive marker changes how Terraform presents a value in ordinary output. It is not encryption and does not, by itself, remove the value from state or saved plans. A team can hide a password in the terminal while still publishing it through a build artifact or giving unnecessary readers access to a state snapshot.
Before starting, identify the Terraform version, backend, CI artifact policy, secret source, and people or services that can read state and plans. Perform validation with synthetic credentials in an isolated configuration. Do not inspect production secrets simply to demonstrate that the risk exists.
1. Map storage and presentation separately
List where a sensitive input travels: variables, provider arguments, resource attributes, outputs, state, plan artifacts, logs, and downstream jobs. Mark each storage boundary and each display boundary. A redacted console screenshot proves only that one presentation path hid the value.
variable "example_token" {
type = string
sensitive = true
}
output "example_token" {
value = var.example_token
sensitive = true
}
This explicitly illustrative fragment is for synthetic test data. It demonstrates presentation behavior, not a recommended token-distribution interface. A real module should avoid exporting credentials when consumers do not need them.
2. Review backend and artifact access
Inspect backend configuration and access controls through approved administration tools. Confirm storage encryption, reader scope, retention, and audit records. Local state is plain data on disk, so source-control exclusions and workstation handling matter as well.
Saved plan files also need controlled access. They can contain values that normal human-readable output redacts. Do not attach a production plan file to a broadly visible issue or preserve it indefinitely as an ordinary build artifact. Review who can download artifacts independently from who may approve infrastructure changes.
3. Test output paths with synthetic values
In a disposable review workspace, compare ordinary output behavior with the documented machine-readable and named-output interfaces. Terraform's JSON and raw output paths can reveal sensitive values. A script consuming them must treat its standard output and downstream files as secret-bearing data.
For an explicitly illustrative example, a CI job marks an input sensitive, then serializes all outputs into a downloadable JSON artifact. Console redaction did not protect that artifact. The correction is to narrow the exported fields and secure any genuinely necessary secret delivery path.
Diagnose the mistaken guarantee
| Observation | Actual boundary | Correction to review |
|---|---|---|
| Terminal shows a sensitive placeholder | Presentation redaction | Verify storage and other interfaces separately |
| Plan artifact is broadly downloadable | Artifact authorization | Limit readers and retention |
| State reader can retrieve a credential | State access | Reduce reader scope or redesign secret flow |
| Secret should never persist in state | Resource and version capability | Evaluate supported ephemeral or write-only paths |
Newer Terraform and provider features can support ephemeral values or write-only arguments in specific contexts. Check the exact version and schema before depending on them. They are not a blanket switch that retroactively removes historical state, plans, logs, or backups.
Verify the correction and maintain a data-handling SOP
Apply reviewed access or configuration changes through the established process. Repeat the synthetic test and confirm intended redaction, artifact restrictions, and downstream handling. If a real credential was previously exposed, rotate it through the credential owner's incident procedure and review historical copies.
Maintain a register of secret-bearing state attributes, plan artifacts, exported outputs, approved readers, and retention. Monitor unexpected state or artifact downloads where audit capabilities permit. Revisit the register whenever a module adds an output or a CI workflow changes its artifact collection rules.
Explore Clouvenix terraform automation for implementation and operational handover.
Technical reference
Managing sensitive data, output values and output block reference.