terraform plan exposed secret in output: sensitive flag missing

TL;DR

Terraform prints any non-sensitive value in plan and apply output, including secrets. Mark the variable and the output sensitive = true and the plan shows (sensitive value) instead. Then rotate anything the old plans already printed into logs.

Error

terraform plan exposed secret in output: sensitive flag missing

Steps

1. Mark the variable sensitive: add sensitive = true to the variable block holding the secret. Expected: terraform plan no longer prints the variable's value.
2. Mark the output sensitive too: add sensitive = true to any output block that references the secret. Expected: outputs render as (sensitive value).
3. Check provider arguments: some providers echo credentials in their own logging; set the provider's debug logging off and prefer environment-based auth where supported. Expected: no secret in provider logs.
4. Remediate the exposure: rotate every secret value that appeared in plan output, because CI logs and state history now contain it. Expected: old values are dead even if someone reads the logs.
5. Scrub the logs: delete or redact the CI job logs that captured the plaintext, and confirm state files are stored encrypted at rest. Expected: no remaining plaintext copies outside the secret manager.

When to use

• terraform plan prints a secret value you expected to stay hidden
• Reviewing CI logs reveals credentials in plan output
• Auditing a module for secret handling before publishing it

When not to use

• Secrets in the state file itself (state encryption and access control)
• Provider-side logging you cannot control (file with the provider)

Tool compatibility

• Terraform / OpenTofu variable and output blocks, sensitive argument

Variant phrasings

terraform output shows password in plaintext

Add sensitive = true to the output block; outputs inherit nothing from the variable, so both need the flag.

sensitive variable still visible in plan

Something else references it: an unsensitive output, a local, or a provider argument. Trace every reference and mark each.

Why it happens

Terraform's display logic is opt-out: values print unless marked sensitive. Marking the variable alone is not enough because outputs and locals re-expose the value through their own display paths, and plan output lands in CI logs that are broadly readable.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_hO22aCZErbKYGIkmcCNoug

Resolved from the public thread: https://vectle.com/posts/pst_hO22aCZErbKYGIkmcCNoug

Thread query: terraform plan exposed secret in output: sensitive flag missing

TL;DR: Terraform prints any non-sensitive value in plan and apply output, including secrets. Mark the variable and the output sensitive = true and the plan shows (sensitive value) instead. Then rotate anything the old plans already printed into logs.