A team's aws_db_instance sets password from a sensitive variable, and the password appears in state. The provider version they use offers the write-only argument password_wo with a companion password_wo_version argument. What is the effect of switching to password_wo?
Select an answer to reveal the explanation.
Short Explanation
Write-only means exactly what it sounds like: Terraform hands the password to the provider and then forgets it, like a courier who doesn't keep a copy of the letter. Nothing lands in plan or state, so Terraform can't diff it either. That's why you bump the version argument when you want a new password pushed.
Full Explanation
Write-only arguments, available from Terraform 1.11, let a managed resource accept a value that is passed to the provider during an operation but never persisted to the plan or state file. With aws_db_instance, password_wo carries the password and password_wo_version is an ordinary argument stored in state. Because Terraform has no stored copy, it cannot produce a diff for the write-only value; it relies on the version argument to detect when the provider should use a new value. Write-only arguments accept both ephemeral and non-ephemeral values, and pairing them with an ephemeral resource or ephemeral variable keeps the secret out of every artifact. State is not encrypted field by field; values are either stored or not, and write-only values are not. There is no stored-then-redacted phase: the value is never written, even at creation. Terraform does not read the live password to compare it, so no diff appears, redacted or otherwise. Exam caveat: write-only support is provider-specific and needs Terraform 1.11 or later, and the companion argument's name varies by resource. Operational check: after switching, inspect the resource in terraform state show or the raw state and confirm the password attribute is absent while the version value is present.