What is your suggestion?

Change examples to ask users to specify a .tfvars file, or use the cloud the host machine may already be authenticated with (e.g kubectx, aws session).

Why do you want this feature?

Remove secrets from being entered in shell or screen recordings

Are there any workarounds to get this functionality today?

A user can edit the template or specify params this #1541

Are you interested in submitting a PR for this?

Yes