How to fix Error: Output refers to sensitive values in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 30, 2025· 112 views

Terraform prevents accidental exposure of sensitive data by blocking outputs that reference sensitive values without explicit handling. This error occurs when you try to output a value derived from sensitive attributes (like passwords, API keys, or tokens) without marking the output as sensitive or stripping the sensitivity.

Quick fix

Fixes Error: Output refers to sensitive values

output "database_password" {
  value     = aws_db_instance.main.password
  sensitive = true
}
  1. Mark the output as sensitive
  2. Retrieve sensitive outputs using -raw flag
  3. Use nonsensitive() only if the data is truly non-sensitive
  4. Protect your state file
terraform — error
output "database_password" {
  value     = aws_db_instance.main.password
  sensitive = true
}
Error: Output refers to sensitive values

What this error means

Terraform automatically marks certain resource attributes as sensitive (database passwords, API keys, tokens from providers like Okta or Datadog). When you reference these sensitive values in an output block, Terraform prevents the output unless you explicitly handle the sensitivity. This is a safety mechanism to prevent accidentally exposing secrets in CLI output, logs, or automation pipelines. Sensitivity propagates through operations: if you use a sensitive value in string interpolation, mathematical operations, or function calls, the result is also marked sensitive. Terraform requires you to either acknowledge this sensitivity with `sensitive = true` on the output block, or use the `nonsensitive()` function to explicitly strip the sensitive designation.

Typical symptoms

  • Terraform apply fails with 'Output refers to sensitive values' error
  • Error appears only when referencing certain resource attributes (passwords, keys, tokens)
  • Error occurs when deriving outputs from sensitive values using functions like `join()`, `base64encode()`, or string interpolation
  • The same output definition works in one Terraform version but fails after upgrading
  • Dependent resources cannot consume the output due to sensitivity propagation

Common causes

  1. Resource attributes are automatically marked sensitive by their provider, and you're referencing them in an output without explicit handling
  2. Using a sensitive value in an expression causes the entire result to be marked sensitive
  3. Migrating from an older Terraform version to 0.15+ which introduced stricter sensitive value handling
  4. Passing sensitive module outputs to child modules without marking them as sensitive
  5. Provider-managed attributes (database passwords, generated tokens) are inherently sensitive by design

How to fix "Error: Output refers to sensitive values"

1Mark the output as sensitive

Add sensitive = true to your output block. This tells Terraform that you understand the output contains sensitive data and should be redacted in CLI output:

hcl
output "database_password" {
  value     = aws_db_instance.main.password
  sensitive = true
}

This is the recommended approach because it preserves security by masking the value in terraform plan, terraform apply, and terraform output commands.

2Retrieve sensitive outputs using -raw flag

When you need to access the actual value, use the -raw flag with terraform output to bypass the sensitive masking:

bash
terraform output -raw database_password

Or use JSON output to access the value programmatically:

bash
terraform output -json database_password

This allows you to work with the value while keeping it redacted from normal CLI output.

3Use nonsensitive() only if the data is truly non-sensitive

If you are certain the value does not actually contain sensitive data (for example, a generated resource ID that happens to be derived from a sensitive attribute), you can use the nonsensitive() function:

hcl
output "public_endpoint" {
  value = nonsensitive(aws_db_instance.main.endpoint)
}

Warning: Only use nonsensitive() if you fully understand that the value is not a secret. Misusing this function can expose sensitive data in logs, state files, and CLI output.

4Protect your state file

Remember that marking an output as sensitive = true only hides it from CLI output. The actual value is still stored in plain text in your Terraform state file. Protect your state file by:

- Using a remote backend with encryption (S3 with encryption enabled, Terraform Cloud, Azure Storage with encryption)
- Restricting access to state files via IAM policies or file permissions
- Using Terraform Cloud or Enterprise for managed state with access controls
- Regularly auditing who has access to state files

Example S3 backend configuration with encryption:

hcl
terraform {
  backend "s3" {
    bucket            = "my-terraform-state"
    key               = "prod/terraform.tfstate"
    region            = "us-east-1"
    encrypt           = true
    dynamodb_table    = "terraform-locks"
  }
}
5Handle sensitive values in modules

When passing sensitive outputs from one module to another, the sensitivity propagates automatically. Make sure to declare module outputs that contain sensitive data as sensitive:

In child module outputs.tf:

hcl
output "api_key" {
  value     = sensitive(random_password.api_key.result)
  sensitive = true
}

In parent module, when using the output:

hcl
resource "example_resource" "main" {
  api_key = module.child.api_key  # Automatically marked sensitive
}

output "service_api_key" {
  value     = module.child.api_key
  sensitive = true  # Must declare as sensitive when outputting
}

This ensures sensitive values are properly handled at every level of your module hierarchy.

Advanced notes

Understanding Sensitivity Propagation: Terraform's type system treats sensitivity as a property that propagates through operations. If you perform any operation on a sensitive value (even simple ones like upper() or join()), the result becomes sensitive. This is intentional to prevent accidental exposure.

State File Encryption: The sensitive = true attribute is a CLI-level mask only. It does NOT encrypt the value in the state file. If you need actual encryption, use a secrets management tool (HashiCorp Vault, AWS Secrets Manager) instead of storing secrets directly in Terraform.

Conditional Sensitivity: You cannot conditionally mark outputs as sensitive based on runtime values. The sensitive argument must be a static boolean.

Sensitive Function vs. Attribute: The sensitive() function marks a specific value as sensitive within expressions:

hcl
locals {
  api_key = sensitive(var.raw_api_key)
}

output "key" {
  value     = local.api_key
  sensitive = true
}

Provider-Specific Sensitivity: Different providers mark different attributes as sensitive. Check your provider documentation to understand which attributes are automatically sensitive (e.g., AWS RDS passwords, Datadog API keys, Kubernetes client certificates).

CI/CD Integration: In CI/CD pipelines, ensure you're using tools that respect Terraform's sensitive output masking. Some CI systems may log terraform output commands, exposing sensitive values. Use -raw carefully and always mask sensitive values in your CI/CD logs.

Frequently asked questions

What does "Error: Output refers to sensitive values" mean?
Terraform automatically marks certain resource attributes as sensitive (database passwords, API keys, tokens from providers like Okta or Datadog). When you reference these sensitive values in an output block, Terraform prevents the output unless you explicitly handle the sensitivity. This is a safety mechanism to prevent accidentally exposing secrets in CLI output, logs, or automation pipelines.
How do I fix "Error: Output refers to sensitive values"?
Terraform prevents accidental exposure of sensitive data by blocking outputs that reference sensitive values without explicit handling. This error occurs when you try to output a value derived from sensitive attributes (like passwords, API keys, or tokens) without marking the output as sensitive or stripping the sensitivity.
What causes "Error: Output refers to sensitive values"?
Resource attributes are automatically marked sensitive by their provider, and you're referencing them in an output without explicit handling Using a sensitive value in an expression causes the entire result to be marked sensitive Migrating from an older Terraform version to 0.15+ which introduced stricter sensitive value handling
Is the "Error: Output refers to sensitive values" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading