Q: How would you pass sensitive data to Terraform if there is currently no Vault or cloud-based Secrets Manager available?

Terraform automatically reads environment variables prefixed with `TF_VAR_`. In CI/CD pipelines (GitHub Actions, GitLab CI), inject secrets from masked pipeline variables into the runner environment at runtime.

# In CI/CD runner script:
export TF_VAR_db_password="$SECRET_FROM_CI_RUNNER"
terraform plan

Use **Mozilla SOPS** (Secrets OPerationS). SOPS allows encrypting values inside `.tfvars.json` or `.yaml` files using local PGP keys or age keys while keeping keys in plaintext. The encrypted file is safely committed to Git, and decrypted on-the-fly during pipeline execution.

# Encrypt secret tfvars file
sops --encrypt --in-place secrets.enc.tfvars.json
# Decrypt during terraform run:
terraform apply -var-file=<(sops -d secrets.enc.tfvars.json)

Declare `sensitive = true` on all input variables in Terraform. This prevents Terraform from printing plaintext passwords in console logs, pipeline terminal streams, and `terraform plan` outputs.

variable "db_password" {
  type      = string
  sensitive = true
}

Remember that Terraform state files store sensitive variables in plaintext JSON! Always enable server-side encryption (SSE-KMS) on the S3 remote state bucket and restrict bucket access with strict IAM policies.