Output refers to sensitive values Terraform Origin: Platform & cloud OSI layer 7 · Application Last updated 5 Nov 2026

Terraform: Error: Output refers to sensitive values — a root module output containing sensitive data must be explicitly marked as sensitive

An output (or module output) exposes a value derived from a sensitive variable/attribute without sensitive = true.

Exact message you may see Error: Output refers to sensitive valuesTo reduce the risk of accidentally exporting sensitive data that was intended to be only internal, Terraform requires that any root module output containing sensitive data be explicitly marked as sensitiveError: Output refers to sensitive values: Expressions used in outputs can only refer to sensitive values if the sensitive attribute is trueError: Invalid for_each argument ... Sensitive values, or values derived from sensitive values, cannot be used as for_each arguments
Explore the map of this error Full error map →
Seen on: Terraform

Meaning

Add sensitive = true to the output, or use nonsensitive() only when you're sure the value isn't secret. Sensitivity propagates through expressions; for_each keys can't be sensitive (separate error). Terraform still stores values in state — protect state.

Common causes

  • Output built from a sensitive variable/resource attribute (passwords, keys)
  • Module output exposing sensitive data
  • Missing sensitive = true
  • for_each using sensitive values
  • Interpolating sensitive values in unrelated outputs

⚡ Quick fix

  1. output "db_password" { value = random_password.db.result sensitive = true }
  2. nonsensitive() only for known-safe values
  3. Avoid secrets in outputs; use a secrets manager

Detailed fix by platform

Terraform

  1. output "token" { value = aws_iam_access_key.k.secret sensitive = true }

How to diagnose

  1. Value — Sensitive source?
  2. Output — sensitive true?
  3. State — Protected?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):

Error building ARM Config: obtain subscription from Azure CLI — Terraform: Error: building AzureRM Client: obtaining subscription ID / Please run 'az login' to setup account (Terraform)Error building ARM Co…Error loading state: AccessDenied (S3 backend) — Terraform: Error: Failed to load state: AccessDenied: Access Denied / Error refreshing state: AccessDenied status code: 403 (Terraform)Error loading state: …Invalid AWS Region — Terraform: Error: Invalid AWS Region: us-east-3 / Error: configuring Terraform AWS Provider: validating provider credentials: operation error STS: GetCallerIdentity (Terraform)Invalid AWS RegionInvalid for_each argument (keys cannot be determined until apply) — Terraform: Error: Invalid for_each argument — The "for_each" map includes keys derived from resource attributes that cannot be determined until apply (Terraform)Invalid for_each argu…Invalid value for input variable — Terraform: Error: Invalid value for variable — "instance_type" must be a t3 type / The given value is not suitable for var.x declared at variables.tf:1,1-17: string required (Terraform)Invalid value for inp…No valid credential sources found (AWS provider) — Terraform: Error: No valid credential sources found — failed to refresh cached credentials, no EC2 IMDS role found / Error: configuring Terraform AWS Provider: no valid credential sources (Terraform)No valid credential s…Unable to process file command — GitHub Actions: Error: Unable to process file command 'output' successfully. Invalid format 'x' (CI/CD)Unable to process fil…UnauthorizedOperation / AccessDenied during Terraform apply — Terraform: Error: creating EC2 Instance: UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::123:user/ci is not authorized to perform: ec2:RunInstances (Terraform)UnauthorizedOperation…Output re…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.