A module exposes a generated database password through an output and marks that output with sensitive = true. A colleague expects that the value will now be encrypted where Terraform records it and hidden everywhere. Which statement most accurately describes what sensitive = true actually does?
output "db_password" {
value = random_password.db.result
sensitive = true
}- AIt encrypts the output value inside the state file and redacts it from CLI output, so the plaintext never appears in state or on screen.
- BIt prevents the output from being written to state at all, so the value exists only transiently during the run and cannot be read afterwards.
- CIt blocks other configurations from reading the output through a remote state data source, restricting access to the declaring module only.
- DIt redacts the value from plan, apply, and output display, but the value is still stored in plaintext in the state file. Correct
Why A is wrong: Tempting because sensitive sounds like encryption, but Terraform state stores sensitive values in plaintext; the flag only affects display, so this overstates the protection.
Why B is wrong: Tempting if a candidate assumes hiding implies exclusion, but outputs are always persisted to state; sensitive does not stop the value being recorded there.
Why C is wrong: Tempting because it sounds like an access control, but sensitive imposes no cross configuration read restriction; a remote state data source can still consume the value.
Why D is correct: Correct: the sensitive flag suppresses the value in CLI output and marks it as sensitive downstream, yet Terraform writes it to state as plaintext, so the state file must still be protected by other means.