HashiCorp Terraform Associate (004) Question 128
Single answer4h Understand best practices for managing sensitive data, including secrets management with VaultA platform team uses Terraform Cloud to provision infrastructure in AWS. Their current configuration hardcodes a database administrator password in a tfvars file, and they have discovered that the password is visible in version control history and can also appear in Terraform state if referenced by resources. They want to improve security by integrating HashiCorp Vault while following Terraform best practices for sensitive data. Which approach is the MOST appropriate?
- A
Store the database password in Vault, have Terraform read it at apply time, mark related input/output values as sensitive where applicable, and restrict access to Terraform state because sensitivity does not remove the value from state.
- B
Base64-encode the database password in the tfvars file and commit it to version control, because Terraform treats encoded values as sensitive and will not store them in state.
- C
Move the password into a Terraform variable marked sensitive and keep it in version control, because the sensitive argument prevents the value from being exposed anywhere, including state and plan data.
- D
Use Vault only to generate the password once, then copy the generated password into local variables in the Terraform configuration so future applies do not need Vault access.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to keep secrets out of version control and use a dedicated secrets manager such as HashiCorp Vault. In Terraform, marking variables or outputs as sensitive helps redact values from normal CLI output and some interfaces, but it does not guarantee that the value will be excluded from state. Terraform state can contain sensitive data when providers need those values to manage resources, so securing the backend and restricting state access are essential best practices. HashiCorp documentation for Terraform sensitive data handling emphasizes that sensitive is about display redaction, not state encryption or removal. Vault documentation and Terraform guidance both support using Vault for secret storage and retrieval instead of hardcoding credentials in configuration files.
- A. Correct.
Correct. This reflects Terraform and Vault best practices. Secrets should not be hardcoded in configuration or committed to version control. Vault is an appropriate system for storing and accessing secrets. Terraform's sensitive marking helps reduce accidental display in CLI output and some UI contexts, but it does not prevent the secret from being stored in state if a provider/resource requires the value. Because of that, access to state must still be tightly controlled. This option correctly combines Vault usage with the important limitation of Terraform's sensitive handling.
- B. Incorrect.
Incorrect. Base64 encoding is not encryption or secrets management. Anyone with repository access can easily decode the value. Terraform does not treat a value as sensitive just because it is encoded, and the value can still be stored in state depending on resource/provider behavior. This distractor targets the misconception that simple obfuscation is equivalent to secure secret storage.
- C. Incorrect.
Incorrect. Marking a variable as sensitive does not make it safe to commit secrets to version control. Sensitive variables are mainly intended to reduce exposure in Terraform output, not to eliminate secret handling risks. In addition, sensitive values may still exist in state when used by resources. This option reflects a common misunderstanding of what the sensitive argument actually protects.
- D. Incorrect.
Incorrect. Although Vault can generate or store the secret, copying that secret into Terraform configuration defeats the purpose of centralized secrets management. It reintroduces the risk of leaking the secret through source control, code review systems, and local files. A best-practice integration keeps secrets in Vault and avoids embedding them into the Terraform codebase.