Terraform interview question · Most asked
How do you handle secrets in Terraform?
Summary
Keep secrets out of code and version control: read them at runtime from a secret manager (AWS Secrets Manager, Vault) through data sources or let services generate and store them (for example RDS-managed master passwords), mark variables and outputs sensitive, and protect the state, because values Terraform reads or creates are stored there in plain text.
Longer Answer
Newer Terraform versions reduce exposure with ephemeral resources and values (not persisted to plan or state) and write-only arguments for passwords, where the provider supports them. Provide credentials to Terraform itself through short-lived identities (OIDC from CI to the cloud), not long-lived keys in variables. Restrict who can read state, enable encryption, and avoid outputting secrets.
Key Points
- No secrets in code or Git.
- Fetch from secret managers or let services manage them.
- State stores values in plain text: protect it.
- Ephemeral/write-only where available; OIDC for CI.
More most-asked Terraform questions
- How would you run Terraform in CI/CD?
- A terraform plan wants to destroy and recreate a database. What do you do?
- What is Terraform state, why is it needed, and where should it be stored?
- count or for_each: when do you use each?
- Walk through terraform init, plan and apply. What does each do?
- What is Terraform, and how does it work at a high level?
- What are Terraform modules, and how do you design good ones?
- What is drift, and how do you detect and handle it?