HashiCorp Terraform Associate (004) Question 126
Single answer4h Understand best practices for managing sensitive data, including secrets management with VaultA team uses Terraform to provision cloud infrastructure and needs to supply database administrator credentials to a managed database service. Their current configuration hardcodes the password in a Terraform variable file committed to Git. They want to improve security while keeping automated Terraform runs in CI/CD. Which approach best aligns with Terraform and Vault best practices for managing this sensitive data?
- A
Store the password in HashiCorp Vault, have Terraform read it at runtime using the Vault provider or data source, and mark related Terraform input/output values as sensitive where applicable.
- B
Encrypt the Terraform variable file with base64 before committing it to Git, then decode it during terraform apply so the password is not stored in plaintext.
- C
Keep the password in a Terraform variable file, but rely on the sensitive = true argument so Terraform will not store it in state.
- D
Output the password as a Terraform output so downstream CI jobs can read it easily, and mark the output as sensitive to fully prevent exposure everywhere.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to store secrets in HashiCorp Vault and retrieve them during Terraform runs rather than hardcoding them in configuration files or version control. This aligns with Terraform guidance to treat secrets carefully and with Vault's purpose as a centralized secrets management solution. Terraform's sensitive flag helps reduce accidental exposure in CLI output, but it is not a secret storage mechanism and does not eliminate the need to secure state files and backends. Base64 is merely encoding, not encryption. Similarly, exposing secrets through Terraform outputs is not a recommended distribution pattern. Relevant best-practice themes from HashiCorp documentation include avoiding secrets in VCS, using Vault for secret retrieval, marking values sensitive when appropriate, and protecting Terraform state because providers may still persist sensitive values there.
- A. Correct.
Correct. Using Vault for secrets management is a recommended practice because it removes hardcoded secrets from version control and allows Terraform to retrieve secrets at runtime. Marking variables or outputs as sensitive helps reduce accidental display in CLI output, but it does not replace proper secrets management. Candidates should also know that sensitive values may still exist in state depending on provider/resource behavior, so securing state storage remains important.
- B. Incorrect.
Incorrect. Base64 encoding is not encryption and provides no meaningful protection. Committing a base64-encoded secret to Git is still committing the secret. This option reflects a common misconception that encoding equals security.
- C. Incorrect.
Incorrect. The sensitive argument controls how values are displayed in Terraform CLI output and plans, but it does not guarantee that the value will be excluded from Terraform state. Storing secrets directly in tfvars files, especially in Git, is not a best practice.
- D. Incorrect.
Incorrect. Marking an output as sensitive suppresses display in some Terraform output contexts, but it does not make exposing the secret through outputs a best practice. Outputs can still be consumed programmatically and sensitive values may still be present in state. Downstream systems should retrieve secrets from a secrets manager instead of depending on Terraform outputs for secret distribution.