Your Terraform code needs to read a secret from AWS Secrets Manager at runtime. Which approach is correct?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: Use an `aws_secretsmanager_secret_version` data source to fetch the secret at plan/apply time

The `aws_secretsmanager_secret_version` data source fetches the secret value from AWS Secrets Manager during `terraform plan`/`apply`. The value will appear in state (mark outputs ...

Real Exam Scenario

Your Terraform code needs to read a secret from AWS Secrets Manager at runtime. Which approach is correct?

✓ Correct Answer & Explanation

Correct Answer

Use an `aws_secretsmanager_secret_version` data source to fetch the secret at plan/apply time

Why This Answer Is Correct

The `aws_secretsmanager_secret_version` data source fetches the secret value from AWS Secrets Manager during `terraform plan`/`apply`. The value will appear in state (mark outputs as `sensitive = true`), but it is never hardcoded in source code. This pattern centralizes secret rotation in Secrets Manager — Terraform always reads the latest version without code changes.