The sensitive = true argument on an output value primarily affects how Terraform displays that value in the command-line interface. When an output is marked as sensitive, its value is redacted from the output of terraform apply and terraform plan. However, the actual value is still recorded in the Terraform state file. This is necessary because other Terraform configurations may need to read this value using the terraformremotestate data source. Therefore, the state file itself must be treated as a sensitive artifact and secured accordingly.

The statement "True" is incorrect because it misrepresents the function of the sensitive argument. The argument's purpose is to prevent accidental exposure in logs and CLI output, not to prevent the value from being stored. The state file must contain the complete state of the managed infrastructure, including the values of all outputs, to function correctly.

1. HashiCorp Terraform Documentation

"Output Values"

section "Sensitive Outputs". This section explicitly states: "An output can be marked as containing sensitive material using the optional sensitive argument... Terraform will still record sensitive values in the state

and so anyone who can access the state data will have access to the sensitive values. For more information

see Sensitive Data in State."

2. HashiCorp Terraform Documentation

"Sensitive Data in State". This page elaborates on the concept: "Terraform state can contain sensitive data... When you use a resource

any arguments or attributes for that resource are stored in plain-text in the state file... The values of output values are also stored in plain-text in the state file." This confirms that output values

regardless of the sensitive flag

are stored in the state.