Terraform 1 11

Terraform 1.11

This overview applies when the project's target Terraform version is at least 1.11.

Write-only data

• Providers can declare write-only resource attributes. Terraform sends their values to the provider but does not persist them in plan or state.
• Write-only attributes can accept ephemeral values, enabling credentials or tokens to flow through a resource operation without state persistence.
• Write-only support is provider-schema dependent; an ordinary sensitive attribute remains persisted even though its display is redacted.

Testing

• terraform test -junit-xml=PATH is generally available for CI test reports.
• override_during = plan makes mocks and overrides take effect during plan-mode test runs; the default remains apply.
• A run block's state_key selects which internal test state the run shares, allowing explicit state isolation or reuse.

Backends and installation

• S3 native state locking with use_lockfile is generally available. DynamoDB locking arguments are deprecated but can coexist temporarily during migration.
• Provider downloads can use credentials from .netrc for registry-provided download and checksum URLs.
• Azure backend authentication aligns with current Azure provider mechanisms and adds workload identity, CLI, client-certificate, and file-based credential options.