You're building a CI/CD pipeline and need to inject sensitive variables into your Terraform run. How can you do this safely?

• A. Pass variables to Terraform with a -var flag
• B. Store the sensitive variables in a secure_vars.tf file
• C. Copy the sensitive variables into your Terraform code
• D. Store the sensitive variables as plain text in a source code repository

Answer: (A)

Injecting sensitive values into Terraform runs in CI/CD should happen at runtime, not by embedding them in code. Passing variables with the -var flag does just that: you provide the secret values from your CI system or secret manager when you run Terraform, so the values aren’t stored in your configuration files. If you mark these variables as sensitive, Terraform will also minimize their exposure in plan and apply output.

The other approaches store secrets in files checked into version control or copied directly into code, which risks leaking credentials and secrets. Plain text in a repository is equally unsafe.