In Terraform, how do `terraform output -json` and `terraform output -raw NAME` differ from plain `terraform output`, and how does each treat values marked sensitive?

## The three forms `terraform output` reads the **root module's** outputs out of state. It does not plan, does not refresh by default, and does not talk to your providers to compute anything — the values were recorded by the last apply. **Human form.** `terraform output` with no flags prints every root output as `name = value`, using HCL-ish rendering, with sensitive values replaced by `<sensitive>`. `terraform output NAME` prints just one, still quoted for strings. **JSON form.** `terraform output -json` prints a single JSON object keyed by output name: ```json { "db_endpoint": { "sensitive": false, "type": "string", "value": "db.internal:5432" }, "db_password": { "sensitive": true, "type": "string", "value": "s3cr3t-actual-value" } } ``` Note what that shows: `sensitive` is a *field describing* the value, sitting next to the value itself in clear text. `-json` is a data interface, not a redaction layer. Adding a name (`terraform output -json NAME`) narrows it to one entry, still wrapped in the same object shape — which is why scripts usually pipe the whole thing through `jq -r '.name.value'`. **Raw form.** `terraform output -raw NAME` prints the value alone, unquoted, with no surrounding structure — exactly what you want inside `$(...)`: ```bash export DB_HOST="$(terraform output -raw db_endpoint)" ``` `-raw` requires a single named output and only works for values that convert cleanly to a string: strings, numbers, booleans. Ask for a list, map, or object and Terraform errors rather than guessing a serialisation — use `-json` and `jq` for those. Like `-json`, `-raw` prints sensitive values in clear text. ## Why the machine forms are not redacted Because redacting them would make them useless. The point of `-raw` is to feed a value into another program; a placeholder would break every consumer. Terraform's position is that the sensitive mark protects against *incidental* disclosure — the value appearing in a diff nobody asked to see — not against a deliberate request for the value by someone who already has state access. Reading state and reading `-json` are the same privilege. The operational consequence is the part worth saying in an interview: a pipeline that carefully avoids printing the plan, but then runs `terraform output -json > outputs.json` and archives it as a build artifact, has published every secret in the workspace. So has one that does `echo "HOST=$(terraform output -raw ...)"` under `set -x`. If a job must pull a sensitive value, it should fetch exactly the one output it needs by name, keep it in a variable rather than a file, and register it with the CI system's own masking mechanism if one exists. ## Practical notes - These commands read **root** outputs only. A child module's output is invisible unless the root re-exports it. - They read the recorded state, so a value that has drifted in the real world is not detected here; `terraform output` is a lookup, not a check. - `-json` is the stable, parseable contract; the human form's rendering is not something to script against. - An output that does not exist in state — never applied, or removed — is an error, not an empty string, which is usually the behaviour you want in a pipeline. - If a value must never be persisted at all, an output is the wrong carrier; Terraform 1.10 added `ephemeral = true` outputs, which are not written to state and can only be consumed by a parent module, never read back with `terraform output`. ## The answer in one breath Plain is for humans and redacts; `-json` is the machine contract and labels sensitivity without hiding it; `-raw` is for shell substitution of one string-like value. Both machine forms print secrets in clear text on purpose.