A new tutorial on HashiCorp Learn shows how to protect sensitive data with Terraform.
HashiCorp Terraform configuration often includes sensitive inputs, such as passwords, API tokens, or Personally Identifiable Information (PII). Terraform provides several features to help avoid accidentally exposing sensitive data.
Follow our new tutorial on HashiCorp Learn, Protect Sensitive Input Variables. In this tutorial, you will provision a web application using Terraform, and use the `sensitive` variable flag to set sensitive values. You will also learn about ways to manage sensitive values in your Terraform state.
New in Terraform 0.14, input variables now support the `sensitive` flag. Terraform will redact the values of sensitive variables in console and log output, to reduce the risk of accidentally disclosing these values.
When you apply this configuration, Terraform redacts the sensitive value from its console output.
This feature helps prevent accidental disclosure of sensitive values, but is not sufficient to fully secure your Terraform configuration.
Even when a variable is marked sensitive, Terraform still needs to store the value in its state file, so that it can correctly apply configuration changes.
In this tutorial, you will learn about several methods that Terraform and other HashiCorp products provide to secure your state file.
Terraform Sentinel policies are now available in the Terraform Registry so you can publish policies you want to share and search the Registry for policies you need.
Cloud Development Kit for Terraform (CDKTF) has reached its first GA release, adding full support for Go and providing a GitHub action to use with Terraform Cloud.
In the journey toward a modern service-based networking solution, core workflows are needed for discovering services, securing service communications, automating networking tasks, and controlling access.