{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-14T20:21:57.226Z",
  "record_id": "VXI-EXT-PROCUREMENT-TERRAFORM-SENSITIVE-STATE-01-v1",
  "record_kind": "external_reference",
  "title": "Terraform: Sensitive display masking is separate from persistence",
  "system": "Terraform",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does marking a Terraform value sensitive keep it out of state and plan files?",
  "near_questions": [
    "Does a masked infrastructure variable disappear from state?",
    "Can sensitive Terraform values persist in plans?",
    "How do sensitive and ephemeral settings differ?",
    "Does every provider support write-only arguments?",
    "Can JSON output expose a sensitive value?",
    "Which backend protects stored state?",
    "What evidence proves a secret was omitted rather than hidden?",
    "Does remote state automatically establish all access controls?",
    "Which Terraform version supports the proposed omission?",
    "What should procurement ask about plan exports?",
    "When should non-persistence remain unproven?",
    "Can I save a Terraform secret-persistence review?"
  ],
  "supported_claims": [
    {
      "claim": "The sensitive setting masks ordinary display, but does not by itself omit values from state or plans. The documentation provides separate ephemeral and write-only mechanisms with version and provider constraints. Review the actual data path and backend rather than accepting a masked screenshot as non-persistence evidence.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "The sensitive setting masks ordinary display, but does not by itself omit values from state or plans. The documentation provides separate ephemeral and write-only mechanisms with version and provider constraints. Review the actual data path and backend rather than accepting a masked screenshot as non-persistence evidence.",
  "related_record_ids": [
    "VXI-EXT-PROCUREMENT-AUTH0-REFRESH-REUSE-01-v1",
    "VXI-EXT-PROCUREMENT-PULUMI-SECRET-RUNTIME-01-v1",
    "VXI-EXT-PROCUREMENT-VAULT-STATIC-LEASE-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Terraform sensitive and ephemeral values",
    "source_url": "https://developer.hashicorp.com/terraform/language/manage-sensitive-data",
    "checked_on": "2026-10-14",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-TERRAFORM-SENSITIVE-STATE-01-v1",
    "candidate_record_sha256": "f693c6115d1621f7f612d5b869c2c1e828e7796ffbac1b2965c7f9aaf4faf48b",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "The sensitive setting masks ordinary display, but does not by itself omit values from state or plans. The documentation provides separate ephemeral and write-only mechanisms with version and provider constraints. Review the actual data path and backend rather than accepting a masked screenshot as non-persistence evidence.",
    "required_buyer_context": "Terraform/provider versions, value flow, sensitive/ephemeral use and backend controls.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-14",
    "claim_to_check": "A sensitive variable cannot persist in infrastructure artifacts.",
    "documented_statement": {
      "status": "documented",
      "statement": "The sensitive setting masks ordinary display, but does not by itself omit values from state or plans. The documentation provides separate ephemeral and write-only mechanisms with version and provider constraints. Review the actual data path and backend rather than accepting a masked screenshot as non-persistence evidence.",
      "source_ids": [
        "terraform-state"
      ]
    },
    "buyer_evidence_required": [
      "Value flow and relevant variable/resource declarations.",
      "Terraform and provider support for omission mechanisms.",
      "State/plan storage, access and export handling."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Do not infer non-persistence from display redaction."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "terraform-state",
        "url": "https://developer.hashicorp.com/terraform/language/manage-sensitive-data",
        "final_url": "https://developer.hashicorp.com/terraform/language/manage-sensitive-data",
        "title": "Terraform sensitive and ephemeral values",
        "checked_on": "2026-10-14",
        "sha256": "b5cf2d1ed17f9445c1d9b8bb85c8c36722f3386f520125666764a220941dbdb8",
        "bytes": 308519
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Save the concrete distinction between hidden output, omitted values and protected artifact storage.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Provider support, language versions and state/export handling."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#terraform-sensitive-state-persistence",
  "machine_readable_record": "/varexis-index/records/terraform-sensitive-state-persistence.json"
}