Which option is not a safe way to inject sensitive values into a Terraform Cloud workspace?

Which option is not a safe way to inject sensitive values into a Terraform Cloud workspace?

• A. Edit the state file directly just before running terraform apply
• B. Set the variable value on the command line with the -var flag
• C. Write the value to a file and specify the file with the -var-file flag
• D. Use Terraform Cloud workspace variable editor

Answer: (C)

The key idea is how to manage sensitive values securely in Terraform Cloud. The safest approach is to store secrets as workspace variables marked sensitive, so they’re masked in logs and not written to disk. Writing the value to a file and using a var-file means the secret lives on disk in the runner’s workspace. That file could end up in version control, be exposed in logs, or be accessible to anyone with access to the runner’s file system, making it easy for secrets to leak. In Terraform Cloud, this bypasses the built‑in secret management and increases the risk of exposure, which is why this method is not safe. Using the Terraform Cloud workspace variable editor is the recommended way to inject sensitive values because it keeps secrets securely managed by the platform and prevents them from leaking through logs or files. The other approaches—passing values on the command line or editing the state—also carry risks, but the file-based var-file method is the one that most clearly creates persistent on-disk secrets and is therefore not safe.

The key idea is how to manage sensitive values securely in Terraform Cloud. The safest approach is to store secrets as workspace variables marked sensitive, so they’re masked in logs and not written to disk.

Writing the value to a file and using a var-file means the secret lives on disk in the runner’s workspace. That file could end up in version control, be exposed in logs, or be accessible to anyone with access to the runner’s file system, making it easy for secrets to leak. In Terraform Cloud, this bypasses the built‑in secret management and increases the risk of exposure, which is why this method is not safe.

Using the Terraform Cloud workspace variable editor is the recommended way to inject sensitive values because it keeps secrets securely managed by the platform and prevents them from leaking through logs or files. The other approaches—passing values on the command line or editing the state—also carry risks, but the file-based var-file method is the one that most clearly creates persistent on-disk secrets and is therefore not safe.