World map

 

BM

World T3: State & Teams

Sensitive values and secrets in state

You will learn: why sensitive hides a secret on screen only, and how to protect the register.

Checked with OpenTofu 1.13 on 1 Nov 2026

The problem

The shop safe gets a PIN from random_password. tofu output prints pin = <sensitive>. Is the PIN safe now?

Try it

Run tofu plan and read the error. Then add sensitive = true to the output in main.tf, and run tofu apply.

Blueprint (your .tf files)init done

  • local_sensitive_file.safenot built yet
  • random_password.pinnot built yet

Built (the state file)

Nothing built yet.

Blueprint: 2 resources. Built: 0.

Change a file, then run tofu plan to see what it means.

Watch

This is part of terraform.tfstate. Tap every line where the PIN shows.

0 of 3 found

A sensitive value: A value hidden in plans and outputs. The state file still keeps it as plain text. is hidden in plans and outputs. The register still keeps it, as plain text.

Try it

The screen hides it, but ask OpenTofu directly: tofu output -raw pin.

Blueprint (your .tf files)init done

  • local_sensitive_file.safe
  • random_password.pin

Built (the state file)state #1

  • local_sensitive_file.safe
  • random_password.pin
pin
(hidden: sensitive)
Blueprint: 2 resources. Built: 2.

Change a file, then run tofu plan to see what it means.

Predict

Your repo is about to be pushed. Sort each file.

Drag a card into a box. Or tap the card, then tap the box.

      Check

      Who should be able to read the register?

      Check

      Swipe: does this protect the register, or does it need work?

      Swipe right for good, left for needs work. Or use the buttons.

      1 / 4

      A backend bucket with encryption and tight access rules

      You did it!

      You can now tell where secrets hide in OpenTofu, and how to protect the register.

      Go deeper (optional)

      OpenTofu 1.11 added ephemeral resources and write-only attributes. They keep a secret out of the register and the plan altogether. Terraform has them too (1.10 and 1.11). Lesson T4·7 shows how a pipeline gets secrets without files.

      Real mission

      1. tofu init && tofu apply
      2. tofu output
      3. grep result terraform.tfstate
      4. printf "*.tfstate\n*.tfstate.*\n.terraform/\n" >> .gitignore

      0 of 4 steps done · Your ticks are saved.