Sensitive output metadata
Mark an output as sensitive
Lesson 8 of 20 · 12 min · Module 3: Protect boundaries and reuse intent
Sensitive metadata changes presentation; it does not encrypt a stored value.
Start this lesson →Free. No installation: you write and run the code in your browser, and it is checked automatically.
By the end, you’ll be able to…
- Classify a value before exposing it
- Keep storage protection separate
The idea
Terraform accepts .tf.json as an alternative configuration representation. Here, built-in terraform_data values make state and plan concepts inspectable without provisioning a cloud resource.
01Classify a value before exposing it
A caller may need to know that an output contains sensitive material. Marking it helps tools avoid casually printing it in normal summaries.
02Keep storage protection separate
Sensitive output flags are not encryption and do not remove the value from state. Real state storage needs appropriate access, protection, and retention controls.
03Use fake values in educational fixtures
example-only is deliberately not a credential. No cloud or account is contacted and the practice logs show plan actions rather than output values.
Your turn
What the checks look for
- Marks the referenced output sensitive
- Keeps only the illustrative fixture
- Does not print the fixture in plan logs
Take this with you
Treat classification, presentation, and protected storage as separate controls.
Go a little further
Write down who should be able to read and modify production state.