Terraform Professional: Securing and Testing Configurations: Sensitive Data, Policy as Code, and Native Testing

Sensitive data

sensitive = true on a variable or output only redacts CLI display. Any expression referencing a sensitive value becomes sensitive itself, and sensitive values are still written to state in plaintext, so encrypt the backend and restrict who can read state. The sensitive() function marks an arbitrary value; nonsensitive() strips the mark and should never touch a real secret. Recent Terraform adds state encryption through an encryption block with key providers, plus ephemeral resources and write-only arguments that keep values out of state entirely. Prefer short-lived credentials from OIDC or workload identity over static keys in variables.

Policy as code

Policy evaluates the plan, not the source code: run terraform plan -out=tfplan, convert with terraform show -json tfplan, then assert against the JSON. HCP Terraform supports Sentinel and OPA; locally conftest and opa test are common. Static analysis tools such as tflint, trivy, and checkov catch misconfiguration earlier and more cheaply.

Native testing

terraform test runs .tftest.hcl files containing run blocks. The command argument defaults to apply; set command = plan for fast unit tests. variables supply inputs, assert blocks pair a condition with an error_message, and expect_failures asserts that a specific variable validation, precondition, or output check does fail - it is valid only with command = plan. mock_provider and override_resource let tests run without cloud credentials, and -filter narrows which files run.

Rule of thumb

Test module contracts with plan-only runs plus expect_failures, and reserve apply runs for integration suites against a disposable account.