How to fix Error: Sensitive value as output without marking as sensitive in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 31, 2025· 120 views

Terraform requires explicit marking of outputs containing sensitive data like passwords or API keys. Add the sensitive = true attribute to any output value that contains secrets to prevent accidental exposure.

Quick fix

Fixes Error: Sensitive value as output without marking as sensitive

output "database_password" {
  value     = aws_db_instance.main.password
  sensitive = true
}

output "api_key" {
  value       = aws_secretsmanager_secret_version.api_key.secret_string
  sensitive   = true
  description = "API key for external service"
}
  1. Mark the output as sensitive
  2. Add description for documentation
  3. View sensitive outputs when needed
  4. Secure state file access
terraform — error
output "database_password" {
  value     = aws_db_instance.main.password
  sensitive = true
}
output "api_key" {
  value       = aws_secretsmanager_secret_version.api_key.secret_string
  sensitive   = true
  description = "API key for external service"
}
Error: Sensitive value as output without marking as sensitive

What this error means

This error occurs when Terraform detects that an output value contains sensitive information (like a database password, API key, or authentication token) but the output has not been explicitly marked with the sensitive = true attribute. Terraform is designed to protect developers from accidentally exposing secrets in CLI output, state files, or logs. Starting with Terraform 0.14+, sensitive data requires explicit declaration to confirm your intent to output it.

Typical symptoms

  • Terraform plan or apply fails with 'Sensitive value as output without marking as sensitive' error
  • Error occurs on specific outputs that reference resource attributes (like aws_db_instance.password)
  • Error happens when outputs are derived from sensitive input variables or resources
  • Error prevents apply from completing until output declaration is fixed

Common causes

  1. An output value references a resource attribute or variable marked as sensitive without declaring the output itself as sensitive
  2. Outputs are using sensitive values from external data sources (AWS Secrets Manager, HashiCorp Vault, etc.) without marking the output
  3. Chained sensitive values: a sensitive variable passed through locals or modules creates sensitive outputs that need explicit marking
  4. Upgrading from Terraform <0.14 to >=0.14 exposes previously hidden sensitive data issues

How to fix "Error: Sensitive value as output without marking as sensitive"

1Mark the output as sensitive

Add the sensitive = true attribute to any output that contains sensitive data:

hcl
output "database_password" {
  value     = aws_db_instance.main.password
  sensitive = true
}

output "api_key" {
  value       = aws_secretsmanager_secret_version.api_key.secret_string
  sensitive   = true
  description = "API key for external service"
}

When marked as sensitive, Terraform will redact these values from plan/apply output and prevent accidental logging.

2Add description for documentation

While sensitive = true is sufficient, best practice is to include a description explaining what the output contains:

hcl
output "rds_password" {
  description = "Auto-generated password for RDS instance (do not commit to version control)"
  value       = aws_db_instance.production.password
  sensitive   = true
}

This helps other team members understand why the output is marked sensitive and how to use it securely.

3View sensitive outputs when needed

Once marked as sensitive, Terraform will show [sensitive] instead of the actual value in CLI output. To view the actual value when needed:

bash
# View all outputs including sensitive ones in JSON format
terraform output -json

# View a specific sensitive output
terraform output -raw database_password

Use these commands carefully and never commit the output to version control or logs.

4Secure state file access

Remember that sensitive values are still stored in plain text in the Terraform state file. Protect state file access:

bash
# Use remote backend with encryption (AWS S3 with encryption, Terraform Cloud, etc.)
# Restrict state file permissions to authorized users only
# Enable state locking to prevent concurrent modifications

State files must be treated as sensitive secrets regardless of output marking.

5Use nonsensitive() function only for debugging

If you need to expose a sensitive value in output (not recommended), use the nonsensitive() function:

hcl
output "debug_password" {
  value = nonsensitive(aws_db_instance.main.password)
}

This should only be used temporarily for debugging. Remove it before deploying to production, as it exposes secrets in logs and state.

6Mark input variables as sensitive

Prevent sensitive values from being displayed when passed through variables:

hcl
variable "db_password" {
  type        = string
  sensitive   = true
  description = "Database password (will be redacted from output)"
}

output "connection_password" {
  value     = var.db_password
  sensitive = true
}

This ensures secrets are protected throughout the entire Terraform execution.

Advanced notes

When working with sensitive data in Terraform, consider these advanced scenarios:

State File Encryption: Terraform state files contain all sensitive data in plain text. Use a remote backend with encryption (Terraform Cloud, AWS S3 with server-side encryption, Azure Storage with encryption, or encrypted PostgreSQL backend).

CI/CD Pipeline Secrets: When running Terraform in CI/CD systems (GitHub Actions, GitLab CI, Azure DevOps), be careful about what gets logged. Set up secret masking to prevent sensitive values from appearing in build logs even after terraform output.

Ephemeral Outputs (Terraform 1.4+): For temporary data like one-time passwords or temporary credentials, consider using the ephemeral output argument to exclude values from state:

hcl
output "temporary_credentials" {
  value     = module.temporary_access.password
  sensitive = true
  ephemeral = true
}

Secrets Rotation: Sensitive outputs containing credentials should be rotated regularly. Document rotation procedures and store previous values securely.

Multi-Environment Security: In organizations with dev/staging/production environments, ensure different access levels to sensitive outputs. Use separate state files per environment and implement RBAC (role-based access control) in your backend.

Frequently asked questions

What does "Error: Sensitive value as output without marking as sensitive" mean?
This error occurs when Terraform detects that an output value contains sensitive information (like a database password, API key, or authentication token) but the output has not been explicitly marked with the sensitive = true attribute. Terraform is designed to protect developers from accidentally exposing secrets in CLI output, state files, or logs. 14+, sensitive data requires explicit declaration to confirm your intent to output it.
How do I fix "Error: Sensitive value as output without marking as sensitive"?
Terraform requires explicit marking of outputs containing sensitive data like passwords or API keys. Add the sensitive = true attribute to any output value that contains secrets to prevent accidental exposure.
What causes "Error: Sensitive value as output without marking as sensitive"?
An output value references a resource attribute or variable marked as sensitive without declaring the output itself as sensitive Outputs are using sensitive values from external data sources (AWS Secrets Manager, HashiCorp Vault, etc.) without marking the output Chained sensitive values: a sensitive variable passed through locals or modules creates sensitive outputs that need explicit marking
Is the "Error: Sensitive value as output without marking as sensitive" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading