What is sensitive = true on a Terraform variable or output?

sensitive = true prevents the value from appearing in plan/apply output ("value is sensitive"). It does NOT encrypt it in the state file — always protect state with encryption at rest and access controls.