When using a remote backend that requires authentication, HashiCorp recommends that you:

When using a remote backend that requires authentication, HashiCorp recommends that you:

• A. Use partial configuration to load the authentication credentials outside of the Terraform code
• B. Push your Terraform configuration to an encrypted git repository
• C. Write the authentication credentials in the Terraform configuration files
• D. Keep the Terraform configuration files in a secret store

Answer: (A)

When a remote backend requires authentication, load the credentials from outside the Terraform code rather than embedding them directly. This approach uses partial configuration: you include the non-sensitive backend settings in your Terraform configuration, while the authentication credentials are provided at runtime through environment variables or a separate credentials file. This keeps secrets out of version control, reduces the risk of leakage, and makes it easy to have environment-specific credentials and rotation without changing the Terraform code. Terraform will combine the static backend settings with the runtime credentials during initialization, enabling access to the remote backend securely. Storing credentials in the configuration itself or pushing everything to an encrypted git repo adds unnecessary risk, and keeping credentials in a secret store can work but isn’t the standard, out-of-band method described by HashiCorp for backend authentication.

When a remote backend requires authentication, load the credentials from outside the Terraform code rather than embedding them directly. This approach uses partial configuration: you include the non-sensitive backend settings in your Terraform configuration, while the authentication credentials are provided at runtime through environment variables or a separate credentials file. This keeps secrets out of version control, reduces the risk of leakage, and makes it easy to have environment-specific credentials and rotation without changing the Terraform code. Terraform will combine the static backend settings with the runtime credentials during initialization, enabling access to the remote backend securely.

Storing credentials in the configuration itself or pushing everything to an encrypted git repo adds unnecessary risk, and keeping credentials in a secret store can work but isn’t the standard, out-of-band method described by HashiCorp for backend authentication.