# Terraform 1 11

> Apply Terraform 1.11 language, CLI, state, testing, migration, and behaviour changes. Load for Terraform work targeting 1.11 or later when the model's knowledge may predate the 2025-02-27 release.

- Skill: `cedws/terraform-1-11` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add cedws/terraform-1-11`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cedws/terraform-1-11/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cedws (https://skillmd.com/u/cedws)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cedws/terraform-1-11

---


# Terraform 1.11

This overview applies when the project's target Terraform version is at least 1.11.

## Write-only data

- Providers can declare write-only resource attributes. Terraform sends their values to the provider but does not persist them in plan or state.
- Write-only attributes can accept ephemeral values, enabling credentials or tokens to flow through a resource operation without state persistence.
- Write-only support is provider-schema dependent; an ordinary sensitive attribute remains persisted even though its display is redacted.

## Testing

- `terraform test -junit-xml=PATH` is generally available for CI test reports.
- `override_during = plan` makes mocks and overrides take effect during plan-mode test runs; the default remains apply.
- A run block's `state_key` selects which internal test state the run shares, allowing explicit state isolation or reuse.

## Backends and installation

- S3 native state locking with `use_lockfile` is generally available. DynamoDB locking arguments are deprecated but can coexist temporarily during migration.
- Provider downloads can use credentials from `.netrc` for registry-provided download and checksum URLs.
- Azure backend authentication aligns with current Azure provider mechanisms and adds workload identity, CLI, client-certificate, and file-based credential options.