diff --git a/terraform/cli.md b/terraform/cli.md
new file mode 100644
index 0000000..b939896
--- /dev/null
+++ b/terraform/cli.md
@@ -0,0 +1,8 @@
+## Terraform CLI
+
+### Getting value of a sensitive object
+
+```
+terraform console
+nonsensitive(nonsensitive(module.applications["myApp"].api_secret_key))
+```