Gain insights into Infrastructure as Code with Terraform, sharpen your skills, and prepare for the HashiCorp Terraform Associate certification in a cloud-agnostic way.

HashiCorp Terraform Certified Associate Preparation Guide.png

Terraform_e.tar.gz

access_key_id

secret_access_key

init

validate

config

needed-copy

not-needed-copy

needed-copy-copy

This course is designed to help learners obtain the Terraform Associate certification from HashiCorp. 

You’ve likely picked up this course because you dabbled in Terraform as a hobbyist or in a
development environment, and you’re excited about the possibilities of deploying Infrastructure 
as Code (IaC). It will enable you to sharpen your skills and prove your knowledge with a certification from HashiCorp. Terraform is an amazing tool to deploy Infrastructure as Code in a cloud-agnostic way. We’re excited to share our accumulated knowledge with you through this course.

HashiCorp Terraform Certified Associate Preparation Guide

The information we submit to Terraform might be of a sensitive nature. We may include things like application passwords, API tokens, or usernames and passwords to authenticate with providers and configure the resources being provisioned by Terraform. This type of sensitive data should be treated with care.

![](/api/collection/10370001/6444696643043328/page/6351969800683520/image/6573593583943680?page_type=collection_lesson)


# Deal with secret data

Here are some recommendations for dealing with secret data.

Don’t store sensitive data in a `tfvars` file. Terraform provides no protections to encrypt or secure variable files, and there’s a good chance that the variable files are being checked into our source control. We shouldn’t let our AWS access and secret keys be released to the world because we checked our variables file into source control.

We can submit our variable values at the command line using the `-var` flag, but even then, our sensitive data is stored in the command history, unobscured.

The easiest alternative is to load sensitive data into environment variables, using the naming convention `TF_VAR_` and the variable name. We can configure these environment variables to pull sensitive data without ever exposing it to the command line, and Terraform won’t show the sensitive data in its output.

# Variables and outputs containing sensitive data

Variables containing `sensitive` data should be marked with sensitive set to `true`. This prevents Terraform from displaying the value in the logging, terminal output, and generated plans. Outputs containing sensitive information should also have the `sensitive` argument set to `true`.

An even better solution would be to use a secrets lifecycle manager to host these sensitive values. HashiCorp Vault, AWS Key Management Service, and Azure Key Vault are all good secure enclaves for storing sensitive data. Terraform can make use of sensitive information stored in these locations through a data source, thereby avoiding local storage of the values.

It’s important to note that sensitive data submitted as part of a resource configuration is stored in the Terraform state. Ideally, state data should be stored in a secure back-end that supports encryption at rest. If we’re using the local file back-end for state storage, we need to make sure that it’s exempted from source control.




Learn how to deal with sensitive data in Terraform.

Introduction to the Course

Introduction to Infrastructure as Code

Basics of Terraform

Outside the Workflow: Using the Terraform CLI

Terraform Modules

Navigate Terraform Workflow

Implement and Maintain State

Read, Generate, and Modify Configuration

Understand Terraform Enterprise Capabilities

Conclusion

Secure Secret Injection Best Practice