sensitive = true stops the echo, not the storage. The complete answer walks the value through git, plan artifacts, state, and provider side effects, naming which mitigation closes which leak.
an account raises the per-topic limit · no card
← Infrastructure as Code & Configuration / 14
hard★ EssentialNewJPMorgan ChaseGoldman SachsRazorpay
Trace a database password from your Terraform pipeline to the resource. Where can it leak, and what closes each hole?
sensitive = true stops the echo, not the storage. The complete answer walks the value through git, plan artifacts, state, and provider side effects, naming which mitigation closes which leak.
Updated Sep 2026 · Grounded in researched DevOps, SRE and platform engineering interview loops, written to a senior-engineer editorial bar, and never padded to hit a word count.
UP NEXT ON YOUR JOURNEY
Next in this trackDesign the CI checks for a Terraform repository. What runs at each stage, and what can each check never catch?Next in this trackA routine change wants to replace a production resource. How do Terraform updates become replacements, and what controls that?Next in this trackAn apply planned to destroy and recreate the production database. Which lifecycle arguments belonged on that resource?
DISCUSSION · 0
Nothing here yet. Say how you would answer it.