TA-003 Question 101

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  Secrets (like API keys, access tokens, or passwords) can be injected via environment variables such as AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, or ARM_CLIENT_SECRET. They are not stored in the Terraform configuration or state files. Most CI/CD systems support securely storing environment variables.

• Chose A2

  https://developer.hashicorp.com/terraform/language/backend Warning: We recommend using environment variables to supply credentials and other sensitive data. If you use -backend-config or hardcode these values directly in your configuration, Terraform will include these values in both the .terraform subdirectory and in plan files. This can leak sensitive credentials.

• Chose A1

  The correct answer is **A. Defined in Environment variables**. Environment variables are considered the most secure place to store secrets for connecting to a Terraform remote backend because: - They keep sensitive information out of source control (such as in `.tf` files or other configuration files). - Secrets stored in environment variables can be managed securely by the operating system or deployment environment and can be encrypted or otherwise protected. Storing secrets inside the backend block (option B) or in a connection configuration outside Terraform (option C) can expose them to version control or make them less secure. Therefore, it's best practice to use environment variables for storing sensitive credentials securely.