When engineers first look to secure their infrastructure pipelines, they usually start by marking their input variables as sensitive = true. It feels like a win—the CLI blocks the plain-text secret from showing up in your CI/CD console outputs or terminal screens.
But there is a major misconception under the hood: masking output is not the same thing as isolating storage.
Standard resource configurations still require Terraform to act as an auditor. It captures the secret value, ships it across the wire to your cloud provider, and then writes the plain-text payload straight into your remote terraform.tfstate file so it can track changes later. If an unauthorized actor compromises your state storage bucket, they compromise every credential managed within it.
True security requires a shift in how data moves through memory. By combining input variables configured with ephemeral = true alongside the AWS provider’s write-only (value_wo) arguments, you change the operational pipeline entirely.
Instead of acting as a permanent vault, Terraform becomes a secure courier. It ingests the secret strictly in memory, transfers it to native platforms like AWS Systems Manager Parameter Store, and drops the tracking data completely. Your state file stays clean, your infrastructure management stores paths instead of keys, and security boundaries are enforced where they belong: at the IAM runtime layer.