Which provider authentication method prevents credentials from being stored in the state file?

Which provider authentication method prevents credentials from being stored in the state file?

• A. Using environment variables
• B. Specifying login credentials in the provider block
• C. Setting credentials as Terraform variables
• D. None of the above

Answer: (A)

Storing credentials securely means ensuring they aren’t written into Terraform state or configuration files. Using environment variables achieves this because Terraform reads those secrets at runtime from the environment and does not persist them in the state file or in the configuration that gets stored or shared. If you place credentials directly in the provider block, or pass them through Terraform variables, those values can end up being saved as part of the configuration or state, increasing the risk of exposure. For example, with the AWS provider you can rely on environment variables like AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, or use a profile, so Terraform can authenticate without writing the secret into the state. This is why environment variables are the best option among the given choices for preventing credentials from being stored in the state file.

Storing credentials securely means ensuring they aren’t written into Terraform state or configuration files. Using environment variables achieves this because Terraform reads those secrets at runtime from the environment and does not persist them in the state file or in the configuration that gets stored or shared. If you place credentials directly in the provider block, or pass them through Terraform variables, those values can end up being saved as part of the configuration or state, increasing the risk of exposure. For example, with the AWS provider you can rely on environment variables like AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, or use a profile, so Terraform can authenticate without writing the secret into the state. This is why environment variables are the best option among the given choices for preventing credentials from being stored in the state file.