HashiCorp Terraform Associate (004) Question 129
Single answer4h Understand best practices for managing sensitive data, including secrets management with VaultA platform team uses Terraform in a CI/CD pipeline to provision database users and application infrastructure. The current configuration reads a database password from a Terraform variable, and the password has appeared in past plan output and is stored in the remote state file. The team wants to reduce secret exposure and adopt HashiCorp Vault where appropriate, while still allowing Terraform to authenticate to cloud providers and provision resources. Which approach best aligns with Terraform and Vault best practices for managing sensitive data in this scenario?
- A
Store the database password in Vault, have Terraform read it at runtime, mark related variables/outputs as sensitive, and use a secured remote backend with restricted access because sensitive values can still exist in state.
- B
Base64-encode the database password before passing it to Terraform variables, because Terraform will then avoid writing the secret to state and plan output.
- C
Move the database password into a local .tfvars file that is excluded from version control, because Terraform does not persist values from .tfvars files in state.
- D
Use Vault only for human access and keep application and provider credentials as plain Terraform variables, because Terraform cannot work with secrets retrieved dynamically from external systems.
Show answer and explanation
Correct answer: A
Explanation
The best answer is Option 1 because it combines the key practices expected for Terraform Associate 004: avoid hardcoding secrets, use a secrets manager such as HashiCorp Vault, mark data as sensitive where supported, and secure the state backend because sensitive values may still be written to state. HashiCorp documentation emphasizes that Terraform state can contain sensitive data and must be protected accordingly. The sensitive argument and sensitive outputs help redact values from normal CLI display, but they do not eliminate all secret exposure risks in state. Vault is a recommended tool for centralized secrets management, including dynamic and short-lived credentials where supported. In practice, teams should also use remote state backends with encryption and strong access controls, restrict who can read state, and avoid passing long-lived static secrets through Terraform when better patterns exist.
- A. Correct.
Correct. This reflects several real best practices. Vault is appropriate for storing and brokering secrets rather than hardcoding them in Terraform configuration or variable files. Terraform can read secrets from Vault during runs, and marking variables or outputs as sensitive helps reduce accidental exposure in CLI output. However, sensitivity in Terraform primarily affects display behavior; it does not guarantee the value will be excluded from state. Because many provider arguments and resource attributes are still recorded in state, you must also secure the backend, enforce access controls, and minimize secret persistence where possible.
- B. Incorrect.
Incorrect. Base64 encoding is not a security control; it is just an encoding format and is easily reversible. Terraform will not treat a base64-encoded secret as protected, and encoding does not prevent values from appearing in state. This option reflects a common misconception that obfuscation is equivalent to secure secret handling.
- C. Incorrect.
Incorrect. Keeping a .tfvars file out of version control can reduce source-code exposure, but it does not prevent Terraform from using the value during planning and applying, and the value can still end up in state depending on how it is used. This option confuses secret storage outside Git with protection from Terraform state persistence.
- D. Incorrect.
Incorrect. Terraform can integrate with external secret systems such as Vault through providers and data sources, and Vault is commonly used for machine and application secrets, not just human access. While teams should be careful about what Terraform reads and stores, the claim that Terraform cannot work with dynamically retrieved secrets is false.