A practitioner reads a credential from Vault with a data source and passes it into a resource. During terraform apply the value still appears in a nearby output block in the console. The team wants the output value redacted from CLI output. What is the correct fix?
output "connection_string" {
value = local.connection_string
}- ARemove the output block entirely, because any output that references a Vault value forces Terraform to print it in clear text.
- BAdd sensitive = true to the output block so Terraform redacts its value in plan and apply output. Correct
- CMove the credential into a separate workspace so the output runs in a context where redaction is applied by default.
- DWrap the value in the nonsensitive function so Terraform recognises it should be hidden from the console.
Why A is wrong: Deleting the output is heavier than needed and the premise is wrong; an output can reference a secret and still be redacted with the right setting.
Why B is correct: Correct: marking the output sensitive suppresses its value in CLI output while still recording it in state, which is the intended redaction control.
Why C is wrong: Workspaces isolate state but do not change how outputs are displayed, so this does nothing to redact the printed value.
Why D is wrong: This is backwards; nonsensitive strips the sensitive marking to reveal a value, so it would expose rather than redact the output.