How to fix Error: Sensitive value as output without marking as sensitive in Terraform

Add the sensitive = true attribute to any output that contains sensitive data:

output "database_password" {
  value     = aws_db_instance.main.password
  sensitive = true
}

output "api_key" {
  value       = aws_secretsmanager_secret_version.api_key.secret_string
  sensitive   = true
  description = "API key for external service"
}

When marked as sensitive, Terraform will redact these values from plan/apply output and prevent accidental logging.

While sensitive = true is sufficient, best practice is to include a description explaining what the output contains:

output "rds_password" {
  description = "Auto-generated password for RDS instance (do not commit to version control)"
  value       = aws_db_instance.production.password
  sensitive   = true
}

This helps other team members understand why the output is marked sensitive and how to use it securely.

Once marked as sensitive, Terraform will show [sensitive] instead of the actual value in CLI output. To view the actual value when needed:

# View all outputs including sensitive ones in JSON format
terraform output -json

# View a specific sensitive output
terraform output -raw database_password

Use these commands carefully and never commit the output to version control or logs.

Remember that sensitive values are still stored in plain text in the Terraform state file. Protect state file access:

# Use remote backend with encryption (AWS S3 with encryption, Terraform Cloud, etc.)
# Restrict state file permissions to authorized users only
# Enable state locking to prevent concurrent modifications

State files must be treated as sensitive secrets regardless of output marking.

If you need to expose a sensitive value in output (not recommended), use the nonsensitive() function:

output "debug_password" {
  value = nonsensitive(aws_db_instance.main.password)
}

This should only be used temporarily for debugging. Remove it before deploying to production, as it exposes secrets in logs and state.

Prevent sensitive values from being displayed when passed through variables:

variable "db_password" {
  type        = string
  sensitive   = true
  description = "Database password (will be redacted from output)"
}

output "connection_password" {
  value     = var.db_password
  sensitive = true
}

This ensures secrets are protected throughout the entire Terraform execution.