# Terraform: Error: Output refers to sensitive values — a root module output containing sensitive data must be explicitly marked as sensitive

**Code:** `Output refers to sensitive values` · **Category:** Terraform · **Seen on:** Terraform

An output (or module output) exposes a value derived from a sensitive variable/attribute without `sensitive = true`.

## Meaning

Add `sensitive = true` to the output, or use `nonsensitive()` only when you're sure the value isn't secret. Sensitivity propagates through expressions; `for_each` keys can't be sensitive (separate error). Terraform still stores values in state — protect state.

## Common causes

- Output built from a sensitive variable/resource attribute (passwords, keys)
- Module output exposing sensitive data
- Missing `sensitive = true`
- `for_each` using sensitive values
- Interpolating sensitive values in unrelated outputs

## Quick fix

1. `output "db_password" { value = random_password.db.result sensitive = true }`
2. `nonsensitive()` only for known-safe values
3. Avoid secrets in outputs; use a secrets manager

## Detailed fix by platform

### Terraform

1. `output "token" { value = aws_iam_access_key.k.secret sensitive = true }`

## How to diagnose

1. **Value** — Sensitive source?
2. **Output** — sensitive true?
3. **State** — Protected?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/terraform/output-refers-to-sensitive-values)