How do you handle secrets in Terraform?
What they are really testing: Whether you know secrets end up in state in plaintext, so the real controls are protecting state and sourcing secrets from a manager, not just marking a variable sensitive.
A real interview question
How do you handle secrets in Terraform?
What most people say
drag me
“I would mark the variables as sensitive so they are hidden.”
sensitive only hides values from console output, the secret is still in the state file in plaintext. The real controls are not committing secrets, securing the state, and sourcing from a secrets manager. Relying on sensitive alone is a false sense of security.
The follow-ups they ask next
Why is marking a variable sensitive not enough on its own?
sensitive only suppresses the value in CLI/log output. The secret is still stored in the state file in plaintext, so without securing the state (encryption, access control) it is still exposed.
What is a better source for secrets than tfvars?
A secrets manager or Vault: pull at apply time via data sources/env, or have Terraform write the generated secret into the manager so the app reads it from there. Avoids long-lived plaintext secrets passing through (and committed near) Terraform.
What the interviewer is listening for
- Knows secrets land in state in plaintext
- Secures state + sources from a secrets manager
- Knows sensitive only hides from logs
What sinks the answer
- Relies on sensitive alone
- Commits secrets in tfvars
- Unaware state holds secrets
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Never [hardcode secrets in .tf or commit .tfvars with secrets]. Know that [any secret Terraform handles is written to state in plaintext], so [secure the state: encryption, access control, never commit it]. Better: [source secrets at apply time from a secrets manager/Vault, or have Terraform store the generated secret there]. [sensitive only hides values from logs, not from state].”
Keep going with iac & automation
Foundation
What is Infrastructure as Code, and why use it instead of clicking through the console?
Foundation
What is the difference between declarative and imperative infrastructure as code?
Junior
What is Terraform state, and why does it exist?
Junior
Explain the Terraform workflow: init, plan, and apply.
Mid
Your team provisions infrastructure with code. Why does idempotency matter, and what breaks without it?
Mid
Why do teams use remote state with locking instead of local state?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free