<p>There isn't a &quot;one-size-fits-all&quot; answer to which approach is the &quot;official&quot; or &quot;accepted&quot; best practice, as it largely depends on factors such as <strong>project requirements, team preferences, and security considerations</strong>. However, you can adopt a hybrid approach that combines the benefits of both perspectives:</p>
<ul>
<li>Use <code>terraform.tfvars</code> files for non-sensitive variables and default configurations.</li>
<li>Exclude sensitive <code>.tfvars</code> files containing credentials or secrets from version control using <code>.gitignore</code>.</li>
<li>Manage sensitive data separately, such as through environment variables or a secrets management system, and reference them in your Terraform configurations.</li>
</ul>
<p>This hybrid approach balances convenience and security, ensuring that sensitive information is protected while maintaining flexibility and ease of use in managing other configuration variables.</p>

CC BY-SA 4.0
2024-04-25T11:23:56.513Z
2024-04-25T11:23:56.513Z
Ajay
<p>I am looking to understand that the &quot;best practice&quot; view on *.tfvars files is, as there appears to be conflicting schools of thought.</p>
<ul>
<li>&quot;<a href="https://www.terraform-best-practices.com/code-structure#getting-started-with-the-structuring-of-terraform-configurations" rel="nofollow noreferrer">Terraform Best Practices</a>&quot; states that terraform.tfvars files should be used in composition</li>
<li><a href="https://github.com/github/gitignore/blob/main/Terraform.gitignore" rel="nofollow noreferrer">GitHub</a> says that *.tfvars should be excluded from VCS entirely.</li>
</ul>
<p>Which is it? I am currently looking to follow the first option, using a terraform.tfvars file to provide values in composition, but I do like to use the GitHub .gitignore files. Is there an official/accepted best practice?</p>

<terraform>
What is the "best practice" way to set Terraform variable values?
James Geddes
# What is the "best practice" way to set Terraform variable values?

(Asked by: username_0 on 2024-04-25)

I am looking to understand that the "best practice" view on \*.tfvars files is, as there appears to be conflicting schools of thought.

* "[Terraform Best Practices](https://www.terraform-best-practices.com/code-structure#getting-started-with-the-structuring-of-terraform-configurations)" states that terraform.tfvars files should be used in composition
* [GitHub](https://github.com/github/gitignore/blob/main/Terraform.gitignore) says that \*.tfvars should be excluded from VCS entirely.

Which is it? I am currently looking to follow the first option, using a terraform.tfvars file to provide values in composition, but I do like to use the GitHub .gitignore files. Is there an official/accepted best practice?

**Tags:** terraform


---

## 1 answers

### Answer by username_1 on 2024-04-25. Score: 1 | Accepted answer

There isn't a "one-size-fits-all" answer to which approach is the "official" or "accepted" best practice, as it largely depends on factors such as **project requirements, team preferences, and security considerations**. However, you can adopt a hybrid approach that combines the benefits of both perspectives:

* Use `terraform.tfvars` files for non-sensitive variables and default configurations.
* Exclude sensitive `.tfvars` files containing credentials or secrets from version control using `.gitignore`.
* Manage sensitive data separately, such as through environment variables or a secrets management system, and reference them in your Terraform configurations.

This hybrid approach balances convenience and security, ensuring that sensitive information is protected while maintaining flexibility and ease of use in managing other configuration variables.


---

