Terraform: Sensitive errors if specified in multiple levels of variables

[douglaswth]

Terraform Version

Terraform v0.14.0
+ provider registry.terraform.io/hashicorp/aws v3.19.0
+ provider registry.terraform.io/hashicorp/external v1.2.0
+ provider registry.terraform.io/hashicorp/random v3.0.0

Terraform Configuration Files

main.tf:

variable "secret" {
  type      = string
  sensitive = true
}

module "module" {
  source = "./module"
  secret = var.secret
}

module/main.tf:

variable "secret" {
  type      = string
  sensitive = true
}

resource "local_file" "secret" {
  content         = var.secret
  filename        = "${path.module}/secret.txt"
  file_permission = "0600"
}

Debug Output

https://gist.github.com/douglaswth/daf02c0a31f51b21db3d945bb2ccba39

Expected Behavior

Either terraform plan or terraform apply should show the expected changes.

Actual Behavior

Instead, both commands error with the following message:

Error: .content: value has marks, so it cannot be serialized

Steps to Reproduce

1. export TF_VAR_secret=secret
2. terraform init
3. terraform apply

References

• #26922

[danieldreier]

I've reproduced this issue and copied the reproduction case to https://github.com/danieldreier/terraform-issue-reproductions/tree/master/27095. Thanks for reporting this with a clear, simple reproduction case @douglaswth!

[nick4fake]

@danieldreier Is there a way to create a minor release for this one? Unfortunately there are no ways to use terraform 0.14 with GKE module due to this bug.

[pselle]

@nick4fake This is going out in the 0.14.1 version, which will be releasing today. And it should only impact users using sensitive on variables, so it should not be blocking any 0.14 migrations. If it somehow is, please share more information and replication in a new issue.

[nick4fake]

Unfortunately I still see "value has marks, so it cannot be serialized" issue, so probably will open a separate ticket.

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.