Gain insights into Infrastructure as Code with Terraform, sharpen your skills, and prepare for the HashiCorp Terraform Associate certification in a cloud-agnostic way.

HashiCorp Terraform Certified Associate Preparation Guide.png

Terraform_e.tar.gz

access_key_id

secret_access_key

init

validate

config

needed-copy

not-needed-copy

needed-copy-copy

This course is designed to help learners obtain the Terraform Associate certification from HashiCorp. 

You’ve likely picked up this course because you dabbled in Terraform as a hobbyist or in a
development environment, and you’re excited about the possibilities of deploying Infrastructure 
as Code (IaC). It will enable you to sharpen your skills and prove your knowledge with a certification from HashiCorp. Terraform is an amazing tool to deploy Infrastructure as Code in a cloud-agnostic way. We’re excited to share our accumulated knowledge with you through this course.

HashiCorp Terraform Certified Associate Preparation Guide

# How to protect sensitive data in the state


State data holds all the information about our configuration, including any sensitive data like passwords, API keys, and access credentials. Terraform doesn’t encrypt the state data, but it can sit on an encrypted storage platform. By using a back-end that provides data encryption, we can add a level of protection for any sensitive data living in the state.

The `sensitive` value designation was introduced in Terraform 0.13, allowing variables, data source attributes, and resource attributes to be labeled as `sensitive`. In logging, terminal output, or plan files, `sensitive` values aren’t  shown in cleartext. While this is a welcome improvement to Terraform as a whole, values marked as `sensitive` are still stored in cleartext in the state data. Labeling a value as `sensitive` doesn’t protect its value in the Terraform state.

When Terraform is using a remote state back-end, the contents of the state are copied to memory only. Unless we direct Terraform to do so, the state data isn’t persisted to disk.

# How to deal with sensitive data

The best practice when dealing with sensitive data is to not store it in the state at all. If we have a secret management platform like HashiCorp Vault, then we can have our applications retrieve sensitive data from there. If we must have sensitive data in our configuration, then it should be stored on a remote back-end that provides encryption of data at rest and in transit.

# Key takeaways

We use a remote state back-end to keep sensitive data off our machine.

Learn how the sensitive data is managed in the state files in Terraform.

Introduction to the Course

Introduction to Infrastructure as Code

Basics of Terraform

Outside the Workflow: Using the Terraform CLI

Terraform Modules

Navigate Terraform Workflow

Implement and Maintain State

Read, Generate, and Modify Configuration

Understand Terraform Enterprise Capabilities

Conclusion

Secret Management in State Files

How to protect sensitive data in the state