Which option cannot be used to keep secrets out of Terraform configuration files?

Which option cannot be used to keep secrets out of Terraform configuration files?

• A. Secure string
• B. Terraform provider
• C. Environment variables
• D. The -var flag

Answer: (A)

In Terraform, you want to avoid placing secret values directly in configuration files and instead provide them at runtime or via external sources. The only option that would not help with that is a secure string, because it implies embedding the secret value as a literal string in the configuration. That would keep secrets in the code, defeating the goal of externalizing them. Environment variables and the -var flag are common ways to supply secrets without hardcoding them in .tf files, and providers can be configured to read credentials from environment variables or secret stores, further keeping secrets out of the configuration itself.

In Terraform, you want to avoid placing secret values directly in configuration files and instead provide them at runtime or via external sources. The only option that would not help with that is a secure string, because it implies embedding the secret value as a literal string in the configuration. That would keep secrets in the code, defeating the goal of externalizing them.

Environment variables and the -var flag are common ways to supply secrets without hardcoding them in .tf files, and providers can be configured to read credentials from environment variables or secret stores, further keeping secrets out of the configuration itself.