HashiCorp Terraform Associate (004) Question 130
Select 24h Understand best practices for managing sensitive data, including secrets management with VaultYour team uses Terraform Cloud to provision infrastructure in AWS. A current configuration passes an AWS access key and database administrator password as input variables through a tfvars file committed to a private Git repository. During a security review, you are asked to redesign the workflow to reduce the risk of secret exposure while keeping Terraform runs automated. Which TWO actions best align with Terraform and Vault best practices for managing sensitive data in this scenario?
- A
Store the secrets in HashiCorp Vault and have Terraform read them at run time or obtain dynamic credentials from Vault instead of committing them to version control.
- B
Mark the Terraform input variables as sensitive so the secret values are fully excluded from Terraform state files and can no longer be retrieved from any backend.
- C
Use Terraform Cloud workspace environment variables or a variables set marked sensitive for values that must be supplied to runs, rather than storing them in committed tfvars files.
- D
Base64-encode the secrets before placing them in the tfvars file so they are not readable by users with repository access.
- E
Output the database password as a sensitive output so operators can retrieve it from the Terraform CLI after each apply without exposing it elsewhere.
Show answer and explanation
Correct answers: A, C
Explanation
The best answer is to remove secrets from version control and use secure delivery mechanisms. HashiCorp recommends treating Terraform state and configuration carefully because sensitive data can be captured in state depending on resource/provider behavior. Using Vault allows teams to centralize secret storage and, where supported, issue dynamic credentials so Terraform does not rely on static long-lived secrets. In Terraform Cloud, sensitive workspace variables or variable sets are appropriate for values that must be injected into runs and should not be committed to Git. Candidates should know that the sensitive argument only redacts values in UI/CLI contexts; it does not mean the secret is absent from state. Relevant best-practice references include Terraform documentation on managing sensitive data and state, Terraform Cloud workspace variables, and Vault usage patterns for dynamic secrets and secret injection.
- A. Correct.
Correct. A core best practice is to avoid storing long-lived secrets in version control and instead retrieve them from a secrets manager such as HashiCorp Vault. Vault can also issue dynamic, short-lived credentials for supported systems, which reduces the blast radius compared with static secrets. This aligns with Terraform guidance to use external secret stores and minimize hardcoded secret material.
- B. Incorrect.
Incorrect. Marking a variable as sensitive changes how Terraform displays the value in CLI output and plans, but it does not guarantee removal from state. Sensitive values can still be stored in the state depending on how they are used by providers and resources. This option reflects a common misconception that the sensitive argument encrypts or eliminates secrets from state.
- C. Correct.
Correct. In Terraform Cloud, sensitive workspace variables and variable sets are the preferred way to pass required secret values into runs without committing them to source control. This improves handling compared with tfvars files in Git, while still supporting automated execution. It is especially appropriate for secrets that cannot yet be replaced with dynamic Vault-issued credentials.
- D. Incorrect.
Incorrect. Base64 encoding is not encryption and provides no meaningful protection. Anyone with repository access can decode the value immediately. This is a common but incorrect attempt to obscure secrets rather than secure them.
- E. Incorrect.
Incorrect. Although Terraform supports sensitive outputs to reduce accidental display, outputting a password for routine operator retrieval is not a best practice. Outputs may still be stored in state, and exposing secrets through outputs increases the chance of disclosure. The better pattern is to retrieve or generate secrets through Vault or inject them securely into the run environment.