What does the `sensitive = true` attribute on a Terraform variable or output actually do?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: Prevents the value from appearing in `terraform plan` and `apply` CLI output, but it is still stored in state

`sensitive = true` redacts the value from Terraform's terminal output (shown as `(sensitive value)`), preventing accidental exposure in logs. However, the value is still persisted ...

Real Exam Scenario

What does the `sensitive = true` attribute on a Terraform variable or output actually do?

✓ Correct Answer & Explanation

Correct Answer

Prevents the value from appearing in `terraform plan` and `apply` CLI output, but it is still stored in state

Why This Answer Is Correct

`sensitive = true` redacts the value from Terraform's terminal output (shown as `(sensitive value)`), preventing accidental exposure in logs. However, the value is still persisted in the state file in plaintext. This is a display-only protection. Proper state security requires encrypted remote backends with restricted access, not just `sensitive = true`.