Q: How do you handle sensitive outputs (like DB passwords) in Terraform modules?
1. Mark outputs as sensitive:
#Terraform #Modules & Structure #L3 #IaC #Cloud Infrastructure #S3
🎙️ Candidate Opening & Architectural Context
""Treat Terraform code with the same rigor as application code: pre-merge plans, state locks, and automated drift detection. When addressing this question, I walk the interviewer through our production incident runbook: isolating the blast radius, checking diagnostic logs and metrics, and applying a safe fix.""
Advertisement
🛠️ Production Runbook & Step-by-Step Resolution
1️⃣
Initial Diagnostics & Root Cause Analysis
Terraform masks the value in plan/apply output.
- Mark outputs as sensitive:
- Don't output secrets if possible — reference the resource directly, or retrieve the secret from Secrets Manager at runtime instead of passing through Terraform output.
- State contains secrets in plaintext — if Terraform creates a password, it's in the state file. Use S3 SSE encryption for the state file. Use a remote backend with access controls.
2️⃣
Remediation & Permanent Safeguards
output "db_password" {
value = aws_db_instance.main.password
sensitive = true
}- Better pattern — let Terraform create the DB, then generate the password in AWS Secrets Manager (using
aws_secretsmanager_secret_version). App retrieves it from Secrets Manager at runtime. Password never in Terraform outputs.
💡 The Senior SRE Gold Nugget (Key Architectural Takeaway)
"Pro-Tip: Mark outputs as sensitive:."
⚡ 60-Second Elevator Pitch Talking Points
- Mark outputs as sensitive:
- Don't output secrets if possible — reference the resource directly, or retrieve the secret from S...
- State contains secrets in plaintext — if Terraform creates a password, it's in the state file. Us...
Advertisement