Which is the safest way to inject sensitive values into a Terraform Cloud workspace?

Which is the safest way to inject sensitive values into a Terraform Cloud workspace?

• A. Write the value to a file and specify the file with the -var-file flag
• B. Set a value for the variable in the UI and check the "Sensitive" check box
• C. Edit the state file directly just before running terraform apply
• D. Set the variable value on the command line with the -var flag

Answer: (B)

Setting the value in the Terraform Cloud UI and marking it as Sensitive keeps secrets out of your code, logs, and history. In Terraform Cloud, a workspace variable marked as Sensitive is stored securely in the backend and masked in the UI and plan outputs, with access controlled by permissions. This prevents the value from being exposed in version control, local files, or command-line history, which is essential for protecting credentials or other secrets. Other approaches expose the secret more easily: writing to a file and using -var-file can put the secret on disk or in files that might be checked in or shared; editing the state file directly is unsafe and can corrupt state or leak data; passing the value on the command line with -var would reveal it in shell history and logs, and isn’t compatible with Terraform Cloud’s remote-run workflow.

Setting the value in the Terraform Cloud UI and marking it as Sensitive keeps secrets out of your code, logs, and history. In Terraform Cloud, a workspace variable marked as Sensitive is stored securely in the backend and masked in the UI and plan outputs, with access controlled by permissions. This prevents the value from being exposed in version control, local files, or command-line history, which is essential for protecting credentials or other secrets.

Other approaches expose the secret more easily: writing to a file and using -var-file can put the secret on disk or in files that might be checked in or shared; editing the state file directly is unsafe and can corrupt state or leak data; passing the value on the command line with -var would reveal it in shell history and logs, and isn’t compatible with Terraform Cloud’s remote-run workflow.