Outputs and Sensitive Values

Scenario: A database password is marked sensitive, so the team assumes it cannot appear in state or be retrieved by authorized CLI users.

Outputs publish a module's supported results and are how parent modules and automation consume values. sensitive = true redacts normal CLI presentation and propagates sensitivity through expressions, but state still stores the value. terraform output -raw can reveal it to an authorized caller. nonsensitive() is an explicit declassification operation and should be rare. Prefer outputting narrow facts rather than entire resource objects.

Analogy: A sensitive label is a privacy screen on a monitor, not an encrypted vault. The underlying record still exists and must be protected.

A worked configuration

output "endpoint" {
  value       = fakecloud_server.api.address
  description = "Stable API endpoint for downstream configuration."
}
output "bootstrap_token" {
  value     = fakecloud_token.api.value
  sensitive = true
}

Encrypt remote state, restrict state access more tightly than code access, avoid unnecessary secret outputs, and use short-lived secrets from a manager such as Vault. Plan files, logs, crash files, and CI artifacts require the same classification.

Warning: Never commit state, saved plans, .tfvars containing secrets, or debug logs. Redaction is an interface behavior, not a storage security boundary.

Goal: Reinforce this lesson in the tf-sensitive-outputs Terraform lab. Open /labs/terraform and choose slug tf-sensitive-outputs; the lab runs real Terraform against the offline FakeCloud provider.