Question

A network engineer manages Cisco IOS XE devices with the Terraform CiscoDevNet/iosxe provider using RESTCONF. The provider block requires a device username and password. Company policy forbids storing plaintext credentials in .tf files or committing them to Git, and requires that the values not appear in CLI output or plan logs. Which approach best meets these requirements while keeping the configuration reusable across environments?

Accepted Answer

Declare input variables for username and password marked with 'sensitive = true', supply their values through environment variables (TF_VAR_username / TF_VAR_password) sourced from a secrets manager at runtime.

Answer

Hardcode the credentials directly in the provider block but add the .tf file to .gitignore so it is never committed.

Answer

Store the credentials in terraform.tfvars committed to a private Git repository and reference them as variables in the provider block.

Answer

Place the credentials in a local backend state file and reference them from the provider block using a data source lookup on the state.