B: HashiCorp Vault is designed for securely storing and dynamically generating secrets, with access controls and auditing.
D: Using environment variables (including TF_VAR_... for input variables) avoids committing secrets to code and works well in CI/CD.
E: HCP Terraform sensitive variables (workspace variables marked sensitive) are a recommended way to store secrets for runs in HCP Terraform without exposing them in the UI or logs (they are masked).
Analysis of Incorrect Options (Distractors):
A: Incorrect. Plaintext on a shared drive is insecure and lacks access control/auditing best practices.
C: Incorrect. Committing secrets to version control is strongly discouraged; even private repos can leak, and history is hard to scrub.
Key Concept:Secrets management best practices in Terraform workflows: keep secrets out of code and VCS; use Vault, HCP Terraform sensitive vars, or environment variables.
[Reference:Manage Terraform Workspaces and Cloud — managing sensitive variables in HCP Terraform; secret handling in Terraform workflows., , , , ]
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit