Sensitive Variable

A sensitive variable is a value OpenTofu hides from console output and plan summaries. It is still stored in state unless another control prevents that, so the setting is about display, not full secret removal. Teams use it to reduce accidental disclosure in logs and user-facing output.

Expanded Definition

A sensitive variable is an OpenTofu value marked for reduced exposure in human-readable output. It is intended to suppress accidental disclosure in console logs, plan summaries, and similar presentation layers, not to eliminate the underlying data from the infrastructure lifecycle. That distinction matters because a hidden value can still be present in state, provider traces, or downstream automation unless those storage and access paths are controlled separately. In practice, sensitive variables sit alongside broader secret handling, but they are not a substitute for secrets management, encryption, or access governance. NHI Management Group treats this as a visibility control rather than a confidentiality guarantee, which aligns with broader access-control thinking in NIST SP 800-53 Rev 5 Security and Privacy Controls. Definitions vary across vendors, but the operational meaning is consistent: reduce accidental display without assuming full removal from persistence layers. The most common misapplication is treating sensitive variables as secret vaulting, which occurs when teams assume hidden output means the value is no longer retrievable from state or automation artifacts.

Examples and Use Cases

Implementing sensitive variables rigorously often introduces a usability tradeoff, requiring organisations to balance operator visibility against the risk of accidental disclosure in diagnostic workflows.

• Marking an API token as sensitive so that Terraform or OpenTofu plans do not print the raw value during reviews.
• Hiding a database password in CI output while still ensuring the credential is stored and rotated in a proper secrets system.
• Masking a service account key in deployment logs to reduce exposure to operators who only need status, not the value itself.
• Using sensitive flags for application configuration that should not appear in chatops notifications, dashboards, or build summaries.
• Pairing sensitive variables with state protection controls after reading the Ultimate Guide to NHIs, which highlights how often secrets remain in vulnerable locations; this is especially important when teams also follow NIST SP 800-53 Rev 5 Security and Privacy Controls for access and audit discipline.

These examples show why the setting is useful in day-to-day automation, but also why it should be treated as one layer in a larger control stack rather than the final safeguard.

Why It Matters in NHI Security

Sensitive variables matter because NHI incidents often begin with disclosure in the wrong place, not with a sophisticated bypass of cryptography. When a token, certificate password, or cloud credential appears in a build log, incident responders face a time-sensitive trust problem: the secret may still be valid, copied into multiple systems, and visible to more people than intended. NHI Management Group research shows that Ultimate Guide to NHIs reports 79% of organisations have experienced secrets leaks, with 77% of those incidents causing tangible damage. That is why hiding a value in output is only useful if paired with rotation, offboarding, and state protection. The term also supports governance language in NIST SP 800-53 Rev 5 Security and Privacy Controls, where limiting exposure is part of broader confidentiality and accountability objectives. Organisations typically encounter the real cost of sensitive variables only after a credential shows up in logs or a plan review, at which point the limitation of output masking becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Sensitive Environment Variable
• When does vibe coding become too risky for sensitive workloads?
• How should security teams prioritize sensitive data findings without relying on volume alone?
• When should a privileged account be marked as sensitive and cannot be delegated?