Advanced AI Prompt for Masking Sensitive Outputs in Terraform State

Act as a Cloud Security Architect. Evaluate and implement a rigorous strategy for masking [SENSITIVE_VARIABLES] (e.g., database passwords, API tokens) explicitly associated with the [OUTPUT_RESOURCES] block in Terraform. Provide the HCL code to declare `sensitive = true` on the outputs. Crucially, outline the severe limitations of this flag—specifically that the values remain in plain text within the raw JSON `.tfstate` file. Propose an advanced [MASKING_METHOD] architecture where Terraform writes the sensitive data directly into an AWS Secrets Manager or HashiCorp Vault resource, and outputs only the Secret ARN, ensuring the actual cryptographic secret never touches the Terraform state or the CI/CD console logs.