How do you handle sensitive data in Terraform configurations?

Sensitive data should never be hardcoded in Terraform files. Instead, use:

• Terraform variables with sensitive flag:

variable "database_password" {
  description = "Database password"
  type        = string
  sensitive   = true
}

• External secret management systems:

data "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "prod/db/password"
}

resource "aws_db_instance" "example" {
  password = data.aws_secretsmanager_secret_version.db_password.secret_string
}

• Environment variables: Use TF_VAR_* environment variables for sensitive inputs
• Terraform Cloud/Enterprise: Use workspace variables marked as sensitive