Question

Your team manages an RDS database with Terraform. A security audit flags that the database master password, passed via a variable marked `sensitive = true`, could still be exposed. Where is this password stored in plaintext, and what is the recommended mitigation?

Accepted Answer

It is stored in plaintext in the state file; encrypt state at rest and restrict backend access using a remote backend that supports encryption and access controls.

Answer

It is never written anywhere because the variable is marked sensitive; no further action is needed.

Answer

It is stored only in the CLI output; redirecting output to /dev/null fully protects the value.

Answer

It is stored in the lock file (.terraform.lock.hcl); adding it to .gitignore resolves the exposure.