Terraform-provider-vault: resource vault_generic_secret should not print out the content of data_json to console

[Vad1mo]

When running and trying to store generated secrets, the secrets are printed out on the screen during planning. This should be avoided as this is a security relevant providers that almost always will contain sensitive data. So by default they should not be printed out.

resource "vault_generic_secret" "example" {
  sensitive = true
  path = "secret/test"
  data_json = "${jsonencode(map("dbpasswd",var.dbpasswd))}"
}

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  + vault_generic_secret.example
      id:           <computed>
      data_json:    "{\"dbpasswd\":\"test123456\"}"
      disable_read: "false"
      path:         "secret/test"

Related to: https://github.com/hashicorp/terraform/issues/16643, https://github.com/hashicorp/terraform/issues/8076

[sidewinder12s]

@tyrannosaurus-becks Can this not be configurable with a default to true?

I was using vault_generic_secret for writing arbitrary configuration data into Vault and now diffs do not work.

[lvets]

Please reopen this. I now get this when I do terraform plan:

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  ~ vault_generic_secret.lcs-role
      data_json: <sensitive> => <sensitive> (attribute changed)

  ~ vault_generic_secret.pki-infra-consul-role
      data_json: <sensitive> => <sensitive> (attribute changed)

  ~ vault_generic_secret.pki-infra-haas-api-role
      data_json: <sensitive> => <sensitive> (attribute changed)

  ~ vault_generic_secret.pki-infra-hana-role
      data_json: <sensitive> => <sensitive> (attribute changed)

  ~ vault_generic_secret.pki-infra-hana-router-role
      data_json: <sensitive> => <sensitive> (attribute changed)

  ~ vault_generic_secret.pki-infra-vault-role
      data_json: <sensitive> => <sensitive> (attribute changed)

  ~ vault_generic_secret.pki-services-hana-gateway-saml-role
      data_json: <sensitive> => <sensitive> (attribute changed)

  ~ vault_generic_secret.pki-services-service-role
      data_json: <sensitive> => <sensitive> (attribute changed)
...

None of the above contains _actual_ sensitive data... but now I cannot see what Terraform wants to change.

Also, why is stuff like this not in the Changelog?