What Is New in Terraform 1.11
Terraform 1.11 introduces write-only attributes for resources, makes JUnit XML output generally available for tests, and brings native S3 state locking out of experimental status.
This release also improves testing flexibility and updates several backend authentication methods.
| Category | Key Changes |
|---|---|
| New Features | Write-only attributes for resources, terraform test -junit-xml (GA), S3 native state locking (GA) |
| Enhancements | .netrc credential support for provider downloads, override_during in test runs, state_key for test runs, updated Azure backend authentication, ca-certificates in official Docker image |
| Bug Fixes | Ephemeral value error messages, TF_VAR_ override warnings, backend interrupt crash, cloud backend saved plan hang |
Write-Only Attributes
Providers can now mark certain resource attributes as write-only. These values are sent to the provider during create and update but are never stored in the Terraform state.
You can safely pass ephemeral values into write-only attributes.
This pattern is especially useful for secrets or temporary tokens that should not persist in state.
Testing Improvements
The terraform test command now officially supports -junit-xml output for integration with CI systems.
Test runs can use mocked or overridden values during the plan phase by setting override_during = plan. You can also control which internal state file is used with the new state_key attribute.
These changes give module authors more precise control when writing comprehensive test suites.
S3 Native State Locking
S3 native state locking is now generally available using the use_lockfile argument.
DynamoDB-related arguments are deprecated in favor of this new mechanism, though you can still use both temporarily during migration.
Most teams will benefit from simpler locking configuration with this native approach.
Backend and Provider Enhancements
Provider installation now respects credentials from .netrc files when downloading from registries.
The Azure backend has been updated with newer authentication methods including CLI, AKS workload identity, certificate, and secret file support.
The official Docker image now includes the ca-certificates package for better downstream certificate handling.
FAQ
What are write-only attributes in Terraform 1.11?
Write-only attributes are sent to the provider during create/update but are not saved in the Terraform state. They support ephemeral values safely.
How do I generate JUnit XML reports from terraform test in version 1.11?
Use the -junit-xml flag. The feature is now generally available after feedback from the experimental phase.
What is the new S3 native state locking in Terraform 1.11?
It uses the use_lockfile argument for native S3 locking. DynamoDB arguments are now deprecated in favor of this mechanism.
Can I override values during the plan phase in terraform test?
Yes, set override_during = plan in the test run block to use overridden or mocked values during planning.
Does Terraform 1.11 improve Azure backend authentication?
Yes, it now aligns with the latest azure provider authentication methods, including support for workload identity, certificates, and secret files.