Terraform Tutorial — Sensitive Outputs

1 minute read

When an output contains sensitive data — passwords, tokens, connection strings — you must mark it as sensitive to prevent Terraform from displaying it in the terminal.

Marking an Output as Sensitive

output "db_password" {
  value     = var.db_password
  sensitive = true
}

After terraform apply:

Outputs:

db_password = <sensitive>

Querying Sensitive Outputs

terraform output hides sensitive values by default:

$ terraform output db_password
<sensitive>

To see the actual value, use -json:

$ terraform output -json db_password
{
  "sensitive": true,
  "type": "string",
  "value": "super-secret-password"
}

Or use -raw (Terraform 1.0+):

$ terraform output -raw db_password
super-secret-password

⚠️ Warning: Be careful with -raw and -json in CI/CD logs. Make sure sensitive outputs aren’t printed to build logs.

When Sensitive is Required

If your output references a sensitive variable or a sensitive resource attribute, Terraform requires you to mark it as sensitive:

variable "api_key" {
  type      = string
  sensitive = true
}

# This FAILS without sensitive = true:
output "api_key_display" {
  value = var.api_key
}

# Error: Output refers to sensitive values
# Add sensitive = true to fix:
output "api_key_display" {
  value     = var.api_key
  sensitive = true
}

Sensitive Output in Expressions

If any part of an expression is sensitive, the entire output must be sensitive:

output "connection_string" {
  value     = "postgresql://admin:${var.db_password}@${aws_db_instance.main.endpoint}/mydb"
  sensitive = true
}

What’s Next?

Outputs are powerful between modules too. Let’s see how to pass data from child modules to root modules.

← Querying Outputs Outputs Across Modules →

You may also enjoy