How to fix Error: Output refers to sensitive values in Terraform

Add sensitive = true to your output block. This tells Terraform that you understand the output contains sensitive data and should be redacted in CLI output:

output "database_password" {
  value     = aws_db_instance.main.password
  sensitive = true
}

This is the recommended approach because it preserves security by masking the value in terraform plan, terraform apply, and terraform output commands.

When you need to access the actual value, use the -raw flag with terraform output to bypass the sensitive masking:

terraform output -raw database_password

Or use JSON output to access the value programmatically:

terraform output -json database_password

This allows you to work with the value while keeping it redacted from normal CLI output.

If you are certain the value does not actually contain sensitive data (for example, a generated resource ID that happens to be derived from a sensitive attribute), you can use the nonsensitive() function:

output "public_endpoint" {
  value = nonsensitive(aws_db_instance.main.endpoint)
}

Warning: Only use nonsensitive() if you fully understand that the value is not a secret. Misusing this function can expose sensitive data in logs, state files, and CLI output.

Remember that marking an output as sensitive = true only hides it from CLI output. The actual value is still stored in plain text in your Terraform state file. Protect your state file by:

- Using a remote backend with encryption (S3 with encryption enabled, Terraform Cloud, Azure Storage with encryption)
- Restricting access to state files via IAM policies or file permissions
- Using Terraform Cloud or Enterprise for managed state with access controls
- Regularly auditing who has access to state files

Example S3 backend configuration with encryption:

terraform {
  backend "s3" {
    bucket            = "my-terraform-state"
    key               = "prod/terraform.tfstate"
    region            = "us-east-1"
    encrypt           = true
    dynamodb_table    = "terraform-locks"
  }
}

When passing sensitive outputs from one module to another, the sensitivity propagates automatically. Make sure to declare module outputs that contain sensitive data as sensitive:

In child module outputs.tf:

output "api_key" {
  value     = sensitive(random_password.api_key.result)
  sensitive = true
}

In parent module, when using the output:

resource "example_resource" "main" {
  api_key = module.child.api_key  # Automatically marked sensitive
}

output "service_api_key" {
  value     = module.child.api_key
  sensitive = true  # Must declare as sensitive when outputting
}

This ensures sensitive values are properly handled at every level of your module hierarchy.