Terraform: local-exec provisioner: suppress sensitive output

[tmaier]

I use the local-exec provisioner with a sensitive variable, e.g. "client_key"

  provisioner "local-exec" {
    command = "echo '${var.client_key}' > ${path.module}/client_key"
  }

The terraform apply command would output the command and the result of the command to stdin.

I propose to add a sensitive argument:

  provisioner "local-exec" {
    command = "echo '${var.client_key}' > ${path.module}/client_key"
    sensitive = true
  }

[danrabinowitz]

For remote-exec too, please.

[mwz]

+1

[apparentlymart]

In the mean time, perhaps passing the sensitive key via environment is a reasonable workaround? Should also sidestep any issues with shell escaping of any metacharacters that might be present in the value.

[pradeepbhadani]

@apparentlymart environment can help to some extent but local-exec also put the bash output to logs which will contain the sensitive info

[ulm0]

Yes, please, this would be really appreciated. I'm trying as well to generate a ssh keypair within terraform, and populate a file with local_file resource, i just need the public key to be print to stdout, yet both of them get printed.

resource "tls_private_key" "ssh" {
  algorithm = "RSA"
  rsa_bits  = 4096
}

resource "local_file" "private_key" {
  count    = "${var.public_ssh_key == "" ? 1 : 0}"
  content  = "${tls_private_key.ssh.private_key_pem}"
  filename = "./keys/id_rsa"
}

resource "local_file" "public_key" {
  count    = "${var.public_ssh_key == "" ? 1 : 0}"
  content  = "${tls_private_key.ssh.public_key_openssh}"
  filename = "./keys/id_rsa.pub"
}

output "public_ssh_key" {
  # Only output a generated ssh public key
  value = "${var.public_ssh_key != "" ? "" : tls_private_key.ssh.public_key_openssh}"
}

Having a sensitive = true field would help

[subesokun]

Any progress on this issue?

[mayeco]

any progress??

[obikay200]

+1

[mayeco]

[apparentlymart]

Adding +1 comments doesn't achieve anything here because we can't report on them; instead, it just creates notification noise for everyone else who is following the issue. Instead, please add :+1: reactions to the original comment (not to _this_ comment), which we can and do report on as one input for prioritization.

[avthart]

Having a sensitive = true field would help

[darren-johnson]

Another vote here!

[moreirodamian]

+1

[omarSterckx]

+1

[JulianGogK24]

PUSH! +1

[chad-barensfeld-exa]

+1

[iscooter]

+1

[mclavel]

variable "super_secret" {
  type        = string
  description = "Use env: TF_VAR_super_secret"
}

resource "null_resource" "super_secret" {
  triggers = {
    hash_super_secret = sha256(var.super_secret)
  }

  provisioner "local-exec" {
    command = "echo $SUPER_SECRET >> /tmp/super_secret.txt"
    environment = {
      SUPER_SECRET = var.super_secret
    }
  }

  provisioner "local-exec" {
    when    = destroy
    command = "rm -f /tmp/super_secret.txt"
  }
}

@apparentlymart idea 😄
@mayeco 👀

[alisdair]

This issue should be addressed as part of the work on sensitive variables and values in Terraform 0.14. When a provider configuration includes a sensitive value (from a sensitive variable, output, or resource attribute), Terraform will suppress logging from the provisioner.

See this screenshot from the #26611 PR, based on the example from @tmaier's original report:

Because the client_key variable is marked sensitive, the derived command is also sensitive, and therefore the normal local-exec logging is suppressed.

If you're interested in this issue, please give this feature a try when you can. It's available in the 0.14.0-beta2 release, out now. We're interested in hearing your feedback!

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.