{
  "schemaVersion": 1,
  "evaluation": {
    "id": "terraform-cli",
    "testedOn": "2026-10-18",
    "coverage": "local-runtime",
    "summary": "A built-in-provider configuration initialized, validated and planned one addition without applying it. Human output hid a sensitive value, but plan JSON contained it; an invalid variable value was rejected.",
    "identity": {
      "version": "1.16.6 windows_amd64",
      "target": "https://releases.hashicorp.com/terraform/1.16.6/terraform_1.16.6_windows_amd64.zip",
      "integrity": "SHA-256 6ea2c186e0e76a113af30fbcdcf7a4b4c70756317994a04929e5c90b9e94b1df of the downloaded ZIP archive. Matched the official release checksum; detached signatures were not verified."
    },
    "environment": [
      "Windows 11 x64; Python 3.12.10 harness. Raw timestamps use UTC.",
      "Fresh per-tool home, config, cache and temporary directories. Child environments used allowlisted OS/runtime paths without inherited account credentials. Only synthetic local files were used.",
      "Configuration isolation is a test control, not an operating-system sandbox.",
      "The fixture disabled backend initialization, inherited credentials and update checks; no cloud account was used."
    ],
    "checks": [
      {
        "id": "terraform-cli-version",
        "name": "Pinned binary version",
        "method": "Command argument array: [\"terraform\", \"version\", \"-json\"].",
        "expected": "Print version 1.16.6 for windows_amd64.",
        "observed": "Exit 0. terraform_version=\"1.16.6\", platform=\"windows_amd64\", provider_selections={}.",
        "outcome": "pass"
      },
      {
        "id": "terraform-cli-init",
        "name": "Initialize the built-in provider fixture",
        "method": "Create main.tf with this exact configuration:\nvariable \"environment\" {\n  type = string\n  default = \"test\"\n  validation {\n    condition = var.environment == \"test\"\n    error_message = \"Only the synthetic test environment is allowed.\"\n  }\n}\nresource \"terraform_data\" \"fixture\" {\n  input = var.environment\n}\noutput \"fixture_token\" {\n  value = \"synthetic-only\"\n  sensitive = true\n}\nUse an empty TF_CLI_CONFIG_FILE, isolated TF_DATA_DIR, CHECKPOINT_DISABLE=1 and no cloud credentials. The resource uses the built-in provider. Command argument array: [\"terraform\", \"init\", \"-backend=false\", \"-input=false\", \"-no-color\"].",
        "expected": "Initialize without configuring a backend or downloading an external provider.",
        "observed": "Exit 0. Initializing provider plugins...\n- terraform.io/builtin/terraform is built in to Terraform\n\nTerraform has been successfully initialized!",
        "outcome": "pass"
      },
      {
        "id": "terraform-cli-validate",
        "name": "Validate the synthetic configuration",
        "method": "Create main.tf with this exact configuration:\nvariable \"environment\" {\n  type = string\n  default = \"test\"\n  validation {\n    condition = var.environment == \"test\"\n    error_message = \"Only the synthetic test environment is allowed.\"\n  }\n}\nresource \"terraform_data\" \"fixture\" {\n  input = var.environment\n}\noutput \"fixture_token\" {\n  value = \"synthetic-only\"\n  sensitive = true\n}\nUse an empty TF_CLI_CONFIG_FILE, isolated TF_DATA_DIR, CHECKPOINT_DISABLE=1 and no cloud credentials. The resource uses the built-in provider. Run the preceding init first. Command argument array: [\"terraform\", \"validate\", \"-json\"].",
        "expected": "Return valid=true with zero errors and warnings.",
        "observed": "Exit 0. valid=true, error_count=0, warning_count=0, diagnostics=[].",
        "outcome": "pass"
      },
      {
        "id": "terraform-cli-plan",
        "name": "Inspect a plan with a sensitive output",
        "method": "Create main.tf with this exact configuration:\nvariable \"environment\" {\n  type = string\n  default = \"test\"\n  validation {\n    condition = var.environment == \"test\"\n    error_message = \"Only the synthetic test environment is allowed.\"\n  }\n}\nresource \"terraform_data\" \"fixture\" {\n  input = var.environment\n}\noutput \"fixture_token\" {\n  value = \"synthetic-only\"\n  sensitive = true\n}\nUse an empty TF_CLI_CONFIG_FILE, isolated TF_DATA_DIR, CHECKPOINT_DISABLE=1 and no cloud credentials. The resource uses the built-in provider. Run init first. Command argument array: [\"terraform\", \"plan\", \"-input=false\", \"-lock=false\", \"-refresh=false\", \"-no-color\", \"-out=fixture.tfplan\"].",
        "expected": "Plan one addition and redact the sensitive value in human output.",
        "observed": "Exit 0. Plan: 1 to add, 0 to change, 0 to destroy. fixture_token appeared as (sensitive value); a local fixture.tfplan was saved.",
        "outcome": "pass"
      },
      {
        "id": "terraform-cli-plan-json",
        "name": "Inspect sensitive output in plan JSON",
        "method": "Use fixture.tfplan from the preceding plan, whose fixture_token is the synthetic string synthetic-only. Command argument array: [\"terraform\", \"show\", \"-json\", \"fixture.tfplan\"].",
        "expected": "Show the raw synthetic value alongside its sensitive marker.",
        "observed": "Exit 0. planned_values.outputs.fixture_token={\"sensitive\":true,\"type\":\"string\",\"value\":\"synthetic-only\"}.",
        "outcome": "pass"
      },
      {
        "id": "terraform-cli-invalid-input",
        "name": "Reject a value outside the fixture validation",
        "method": "Create main.tf with this exact configuration:\nvariable \"environment\" {\n  type = string\n  default = \"test\"\n  validation {\n    condition = var.environment == \"test\"\n    error_message = \"Only the synthetic test environment is allowed.\"\n  }\n}\nresource \"terraform_data\" \"fixture\" {\n  input = var.environment\n}\noutput \"fixture_token\" {\n  value = \"synthetic-only\"\n  sensitive = true\n}\nUse an empty TF_CLI_CONFIG_FILE, isolated TF_DATA_DIR, CHECKPOINT_DISABLE=1 and no cloud credentials. The resource uses the built-in provider. Run init first. Command argument array: [\"terraform\", \"plan\", \"-input=false\", \"-lock=false\", \"-refresh=false\", \"-no-color\", \"-var=environment=production\"].",
        "expected": "Reject environment=production with the explicit validation message.",
        "observed": "Exit 1. Invalid value for variable: Only the synthetic test environment is allowed.",
        "outcome": "pass"
      }
    ],
    "findings": [
      {
        "title": "Sensitive markers do not remove values from plan JSON",
        "basis": "observed",
        "severity": "medium",
        "detail": "The human plan showed a sensitive placeholder. terraform show -json returned the synthetic-only value with sensitive=true. This is documented behavior and a practical artifact-handling concern, not a newly discovered vulnerability.",
        "practicalAdvice": "Protect plan files, state and JSON exports; do not send them to public logs or broad review systems without careful handling."
      },
      {
        "title": "Local validation rejected the configured forbidden value",
        "basis": "observed",
        "severity": "informational",
        "detail": "The fixture allowed only environment=test. Passing environment=production returned exit 1 with the authored validation message. No remote resource or policy was involved.",
        "practicalAdvice": "Use input validation for useful early checks, while retaining backend, IAM and policy controls for real infrastructure."
      }
    ],
    "caveats": [
      "No plan was applied and no external provider was installed. The test used terraform_data and an isolated local working directory.",
      "-lock=false and -refresh=false were bounded test choices; they are not recommended defaults for shared production state."
    ],
    "notTested": [
      "Apply or destroy, real cloud providers, remote backends, credentials, IAM and production infrastructure changes.",
      "State locking, drift, concurrent runs, provider or module supply chains and complete secret handling."
    ],
    "sources": [
      {
        "label": "Terraform CLI",
        "url": "https://developer.hashicorp.com/terraform/cli"
      },
      {
        "label": "JSON show output and sensitive values",
        "url": "https://developer.hashicorp.com/terraform/cli/commands/show"
      },
      {
        "label": "Sensitive data handling",
        "url": "https://developer.hashicorp.com/terraform/language/manage-sensitive-data"
      },
      {
        "label": "Terraform editions",
        "url": "https://developer.hashicorp.com/terraform/intro/terraform-editions"
      },
      {
        "label": "Terraform repository",
        "url": "https://github.com/hashicorp/terraform"
      },
      {
        "label": "Business Source License",
        "url": "https://github.com/hashicorp/terraform/blob/main/LICENSE"
      }
    ],
    "reportUrl": "/interface-evaluations/terraform-cli.json"
  }
}