Which method is recommended for supplying sensitive variables to Terraform during automation?

Which method is recommended for supplying sensitive variables to Terraform during automation?

• A. Hardcode in configuration
• B. Embed in provider plugin
• C. Use the -var flag to pass the variables
• D. Store in plaintext in VCS

Answer: (C)

When automating Terraform, secrets should not be baked into code or stored in plaintext. The best approach is to provide sensitive values at runtime through the Terraform CLI, such as with the -var flag (and you can pair this with a -var-file or environment variables). This keeps secrets out of the configuration and version control, which reduces the risk of leakage in pipelines or code repos, while still allowing automated deployments to inject the values you need for each environment. The other options place secrets directly in the codebase or plugins, or store them in plaintext in VCS, which is insecure and prone to exposure. Using -var to pass variables aligns with secure, repeatable automation and keeps the configuration environment-agnostic.

When automating Terraform, secrets should not be baked into code or stored in plaintext. The best approach is to provide sensitive values at runtime through the Terraform CLI, such as with the -var flag (and you can pair this with a -var-file or environment variables). This keeps secrets out of the configuration and version control, which reduces the risk of leakage in pipelines or code repos, while still allowing automated deployments to inject the values you need for each environment. The other options place secrets directly in the codebase or plugins, or store them in plaintext in VCS, which is insecure and prone to exposure. Using -var to pass variables aligns with secure, repeatable automation and keeps the configuration environment-agnostic.