Task 5.1: Identify best practices for secrets

• ANothing leaks, as each download link also needs the masked team token

  Incorrect

  Archivist download links need no bearer token; the authorization travels inside the URL itself.

• BThe links never expire, so the logged state stays downloadable for good

  Incorrect

  The signed token in each link is short-term, with an expiry that depends on the API endpoint that returned it.

• CThe links serve state with sensitive values redacted, so only IDs leak

  Incorrect

  hosted-state-download-url returns the raw state data, and state versions can hold sensitive data such as database passwords.

• DEach link holds a short-term signed token, so log readers can fetch state

  Correct

  Archivist URLs carry a short-term signed authorization token, so HashiCorp says to treat them as secrets and avoid logging or sharing them.

A masked API token does not protect what the API returns. Drop or mask the Archivist URL fields before a job logs a response, and download state only inside the job that needs it.

• AMark every sensitive variable and output as sensitive and ephemeral

  Incorrect

  That keeps some values out of artifacts, but HCP Terraform can still read the rest of the state and plan data with its own key.

• BHold your own key, with HCP Terraform agents encrypting state and plan files using the team's KMS key

  Correct

  HYOK encrypts state and plan files with a key the team controls, and sanitized copies let policy checks, run tasks and cost estimation keep working.

• CSwitch the workspaces to local execution mode and run every plan on the team's own machines

  Incorrect

  In local execution mode the workspace still stores state in HCP Terraform, encrypted with HashiCorp's key.

• DMove state to an S3 backend with encrypt = true and keep only runs in HCP Terraform

  Incorrect

  A workspace's runs use the state stored in HCP Terraform; a backend block is overridden in remote runs.

By default HCP Terraform encrypts artifacts with a HashiCorp-managed key and can read them. Hold your own key (Premium) puts encryption under your KMS, and once enabled on a workspace it cannot be disabled.

• ATerraform rejects any value that is not ephemeral

  Incorrect

  Unlike other ephemeral constructs, write-only arguments are not limited to ephemeral values.

• BThe value is stored in state as it is not ephemeral

  Incorrect

  Write-only values are never persisted to state or plan files.

• CBoth kinds work, though ephemeral values are recommended

  Correct

  Write-only arguments accept ephemeral and non-ephemeral values, and HashiCorp recommends passing ephemeral values to them.

• DIt works only on Terraform v1.10, before stricter rules arrived

  Incorrect

  Write-only arguments require Terraform v1.11 or later.

Keep the variable itself ephemeral too, or its value may still reach state through other references.

• AProvisioners print their command lines, values included

  Incorrect

  Terraform suppresses sensitive values in the log output of provisioners.

• BProvisioners reject sensitive values with an error

  Incorrect

  You can use sensitive values in provisioner blocks.

• COnly remote-exec hides them; local-exec prints them as is

  Incorrect

  The suppression applies to all log output, whichever provisioner runs.

• DTerraform suppresses sensitive values in all log output

  Correct

  The documentation says you can use sensitive values in provisioner blocks and that Terraform suppresses them in all log output.

Suppression covers Terraform's own log output. The tool may still write the value somewhere else, so check what it logs or stores.

• Aephemeralasnull()

  Correct

  ephemeralasnull returns null for ephemeral values, nullifying any ephemeral values nested inside an object.

• Bnonsensitive(), on the whole object

  Incorrect

  nonsensitive removes sensitive markings, not ephemerality.

• Csensitive(), which hides the token

  Incorrect

  Sensitive values are still persisted.

• DA local value that copies the object

  Incorrect

  A local that references an ephemeral value is itself ephemeral.

ephemeralasnull is available in Terraform v1.10 and later.

• Acan(sensitive(var.api_key))

  Incorrect

  can only reports whether the expression errors.

• Bissensitive(var.api_key)

  Correct

  issensitive returns true if Terraform treats the value as sensitive and false otherwise.

• Cnonsensitive(var.api_key) != null

  Incorrect

  nonsensitive only removes a marking, so comparing its result with null says nothing about whether the value was sensitive.

• Dlength(var.api_key) > 0

  Incorrect

  Length says nothing about sensitivity.

issensitive is available in Terraform v1.8 and later.