From bd744ad4e911daa60ccb0b7af51a45652b2b0743 Mon Sep 17 00:00:00 2001 From: Brandon Croft Date: Thu, 20 Oct 2022 10:09:21 -0600 Subject: [PATCH] Unify all sensitive value plan output as "(sensitive value)" Previously, there was mixed usage of "(sensitive)" and "(sensitive value)" and even though it was more common to see "(sensitive)", the thought is that it's a value we are hiding rather than describing something already shown. --- internal/command/console_test.go | 4 +- internal/command/format/diff.go | 20 +++-- internal/command/format/diff_test.go | 74 +++++++++---------- internal/repl/format.go | 2 +- internal/repl/format_test.go | 4 +- .../language/expressions/function-calls.mdx | 4 +- .../docs/language/expressions/references.mdx | 2 +- .../docs/language/functions/nonsensitive.mdx | 6 +- website/docs/language/functions/sensitive.mdx | 6 +- website/docs/language/values/outputs.mdx | 2 +- website/docs/language/values/variables.mdx | 6 +- 11 files changed, 67 insertions(+), 63 deletions(-) diff --git a/internal/command/console_test.go b/internal/command/console_test.go index 13b743547e23..de8060c5b587 100644 --- a/internal/command/console_test.go +++ b/internal/command/console_test.go @@ -172,8 +172,8 @@ func TestConsole_variables(t *testing.T) { commands := map[string]string{ "var.foo\n": "\"bar\"\n", "var.snack\n": "\"popcorn\"\n", - "var.secret_snack\n": "(sensitive)\n", - "local.snack_bar\n": "[\n \"popcorn\",\n (sensitive),\n]\n", + "var.secret_snack\n": "(sensitive value)\n", + "local.snack_bar\n": "[\n \"popcorn\",\n (sensitive value),\n]\n", } args := []string{} diff --git a/internal/command/format/diff.go b/internal/command/format/diff.go index 0ea6a694f588..8b4e65aed8d1 100644 --- a/internal/command/format/diff.go +++ b/internal/command/format/diff.go @@ -274,7 +274,10 @@ type blockBodyDiffResult struct { skippedBlocks int } -const forcesNewResourceCaption = " [red]# forces replacement[reset]" +const ( + forcesNewResourceCaption = " [red]# forces replacement[reset]" + sensitiveCaption = "(sensitive value)" +) // writeBlockBodyDiff writes attribute or block differences // and returns true if any differences were found and written @@ -416,7 +419,7 @@ func (p *blockBodyDiffPrinter) writeAttrDiff(name string, attrS *configschema.At p.buf.WriteString(" = ") if attrS.Sensitive { - p.buf.WriteString("(sensitive)") + p.buf.WriteString(sensitiveCaption) if p.pathForcesNewResource(path) { p.buf.WriteString(p.color.Color(forcesNewResourceCaption)) } @@ -459,7 +462,8 @@ func (p *blockBodyDiffPrinter) writeNestedAttrDiff( // Then schema of the attribute itself can be marked sensitive, or the values assigned sensitive := attrWithNestedS.Sensitive || old.HasMark(marks.Sensitive) || new.HasMark(marks.Sensitive) if sensitive { - p.buf.WriteString(" = (sensitive)") + p.buf.WriteString(" = ") + p.buf.WriteString(sensitiveCaption) if p.pathForcesNewResource(path) { p.buf.WriteString(p.color.Color(forcesNewResourceCaption)) @@ -742,7 +746,7 @@ func (p *blockBodyDiffPrinter) writeNestedBlockDiffs(name string, blockS *config // If either the old or the new value is marked, // Display a special diff because it is irrelevant - // to list all obfuscated attributes as (sensitive) + // to list all obfuscated attributes as (sensitive value) if old.HasMark(marks.Sensitive) || new.HasMark(marks.Sensitive) { p.writeSensitiveNestedBlockDiff(name, old, new, indent, blankBefore, path) return 0 @@ -1025,7 +1029,7 @@ func (p *blockBodyDiffPrinter) writeNestedBlockDiff(name string, label *string, func (p *blockBodyDiffPrinter) writeValue(val cty.Value, action plans.Action, indent int) { // Could check specifically for the sensitivity marker if val.HasMark(marks.Sensitive) { - p.buf.WriteString("(sensitive)") + p.buf.WriteString(sensitiveCaption) return } @@ -1193,7 +1197,7 @@ func (p *blockBodyDiffPrinter) writeValueDiff(old, new cty.Value, indent int, pa // values are known and non-null. if old.IsKnown() && new.IsKnown() && !old.IsNull() && !new.IsNull() && typesEqual { if old.HasMark(marks.Sensitive) || new.HasMark(marks.Sensitive) { - p.buf.WriteString("(sensitive)") + p.buf.WriteString(sensitiveCaption) if p.pathForcesNewResource(path) { p.buf.WriteString(p.color.Color(forcesNewResourceCaption)) } @@ -1564,7 +1568,7 @@ func (p *blockBodyDiffPrinter) writeValueDiff(old, new cty.Value, indent int, pa case plans.Create, plans.NoOp: v := new.Index(kV) if v.HasMark(marks.Sensitive) { - p.buf.WriteString("(sensitive)") + p.buf.WriteString(sensitiveCaption) } else { p.writeValue(v, action, indent+4) } @@ -1574,7 +1578,7 @@ func (p *blockBodyDiffPrinter) writeValueDiff(old, new cty.Value, indent int, pa p.writeValueDiff(oldV, newV, indent+4, path) default: if oldV.HasMark(marks.Sensitive) || newV.HasMark(marks.Sensitive) { - p.buf.WriteString("(sensitive)") + p.buf.WriteString(sensitiveCaption) } else { p.writeValueDiff(oldV, newV, indent+4, path) } diff --git a/internal/command/format/diff_test.go b/internal/command/format/diff_test.go index 33040380c248..5ab9502c37b1 100644 --- a/internal/command/format/diff_test.go +++ b/internal/command/format/diff_test.go @@ -411,11 +411,11 @@ new line ExpectedOutput: ` # test_instance.example will be created + resource "test_instance" "example" { + conn_info = { - + password = (sensitive) + + password = (sensitive value) + user = "not-secret" } + id = (known after apply) - + password = (sensitive) + + password = (sensitive value) } `, }, @@ -3048,7 +3048,7 @@ func TestResourceChange_nestedSet(t *testing.T) { ExpectedOutput: ` # test_instance.example will be created + resource "test_instance" "example" { + ami = "ami-AFTER" - + disks = (sensitive) + + disks = (sensitive value) + id = "i-02ae66f368e8518a9" + root_block_device { @@ -3146,7 +3146,7 @@ func TestResourceChange_nestedSet(t *testing.T) { ~ ami = "ami-BEFORE" -> "ami-AFTER" # Warning: this attribute value will be marked as sensitive and will not # display in UI output after applying this change. - ~ disks = (sensitive) + ~ disks = (sensitive value) id = "i-02ae66f368e8518a9" + root_block_device { @@ -3197,7 +3197,7 @@ func TestResourceChange_nestedSet(t *testing.T) { ~ ami = "ami-BEFORE" -> "ami-AFTER" # Warning: this attribute value will be marked as sensitive and will not # display in UI output after applying this change. The value is unchanged. - ~ disks = (sensitive) + ~ disks = (sensitive value) id = "i-02ae66f368e8518a9" } `, @@ -3965,7 +3965,7 @@ func TestResourceChange_nestedMap(t *testing.T) { ~ ami = "ami-BEFORE" -> "ami-AFTER" ~ disks = { + "disk_a" = { - + mount_point = (sensitive) + + mount_point = (sensitive value) + size = "50GB" }, } @@ -5728,18 +5728,18 @@ func TestResourceChange_sensitiveVariable(t *testing.T) { }, ExpectedOutput: ` # test_instance.example will be created + resource "test_instance" "example" { - + ami = (sensitive) + + ami = (sensitive value) + id = "i-02ae66f368e8518a9" + list_field = [ + "hello", - + (sensitive), + + (sensitive value), + "!", ] + map_key = { + "breakfast" = 800 - + "dinner" = (sensitive) + + "dinner" = (sensitive value) } - + map_whole = (sensitive) + + map_whole = (sensitive value) + nested_block_list { # At least one attribute in this block is (or was) sensitive, @@ -5882,29 +5882,29 @@ func TestResourceChange_sensitiveVariable(t *testing.T) { ~ resource "test_instance" "example" { # Warning: this attribute value will no longer be marked as sensitive # after applying this change. - ~ ami = (sensitive) + ~ ami = (sensitive value) id = "i-02ae66f368e8518a9" ~ list_field = [ # (1 unchanged element hidden) "friends", - - (sensitive), + - (sensitive value), + ".", ] ~ map_key = { # Warning: this attribute value will no longer be marked as sensitive # after applying this change. - ~ "dinner" = (sensitive) + ~ "dinner" = (sensitive value) # (1 unchanged element hidden) } # Warning: this attribute value will no longer be marked as sensitive # after applying this change. - ~ map_whole = (sensitive) + ~ map_whole = (sensitive value) # Warning: this attribute value will no longer be marked as sensitive # after applying this change. - ~ some_number = (sensitive) + ~ some_number = (sensitive value) # Warning: this attribute value will no longer be marked as sensitive # after applying this change. - ~ special = (sensitive) + ~ special = (sensitive value) # Warning: this block will no longer be marked as sensitive # after applying this change. @@ -6007,18 +6007,18 @@ func TestResourceChange_sensitiveVariable(t *testing.T) { id = "i-02ae66f368e8518a9" ~ list_field = [ - "hello", - + (sensitive), + + (sensitive value), "friends", ] ~ map_key = { ~ "breakfast" = 800 -> 700 # Warning: this attribute value will be marked as sensitive and will not # display in UI output after applying this change. - ~ "dinner" = (sensitive) + ~ "dinner" = (sensitive value) } # Warning: this attribute value will be marked as sensitive and will not # display in UI output after applying this change. - ~ map_whole = (sensitive) + ~ map_whole = (sensitive value) # Warning: this block will be marked as sensitive and will not # display in UI output after applying this change. @@ -6143,15 +6143,15 @@ func TestResourceChange_sensitiveVariable(t *testing.T) { ~ ami = (sensitive value) id = "i-02ae66f368e8518a9" ~ list_field = [ - - (sensitive), - + (sensitive), + - (sensitive value), + + (sensitive value), "friends", ] ~ map_key = { - ~ "dinner" = (sensitive) + ~ "dinner" = (sensitive value) # (1 unchanged element hidden) } - ~ map_whole = (sensitive) + ~ map_whole = (sensitive value) ~ nested_block_map { # At least one attribute in this block is (or was) sensitive, @@ -6289,29 +6289,29 @@ func TestResourceChange_sensitiveVariable(t *testing.T) { ~ resource "test_instance" "example" { # Warning: this attribute value will no longer be marked as sensitive # after applying this change. The value is unchanged. - ~ ami = (sensitive) + ~ ami = (sensitive value) id = "i-02ae66f368e8518a9" ~ list_field = [ # (1 unchanged element hidden) "friends", - - (sensitive), + - (sensitive value), + "!", ] ~ map_key = { # Warning: this attribute value will no longer be marked as sensitive # after applying this change. The value is unchanged. - ~ "dinner" = (sensitive) + ~ "dinner" = (sensitive value) # (1 unchanged element hidden) } # Warning: this attribute value will no longer be marked as sensitive # after applying this change. The value is unchanged. - ~ map_whole = (sensitive) + ~ map_whole = (sensitive value) # Warning: this attribute value will no longer be marked as sensitive # after applying this change. The value is unchanged. - ~ some_number = (sensitive) + ~ some_number = (sensitive value) # Warning: this attribute value will no longer be marked as sensitive # after applying this change. The value is unchanged. - ~ special = (sensitive) + ~ special = (sensitive value) # Warning: this block will no longer be marked as sensitive # after applying this change. @@ -6410,17 +6410,17 @@ func TestResourceChange_sensitiveVariable(t *testing.T) { }, ExpectedOutput: ` # test_instance.example will be destroyed - resource "test_instance" "example" { - - ami = (sensitive) -> null + - ami = (sensitive value) -> null - id = "i-02ae66f368e8518a9" -> null - list_field = [ - "hello", - - (sensitive), + - (sensitive value), ] -> null - map_key = { - "breakfast" = 800 - - "dinner" = (sensitive) + - "dinner" = (sensitive value) } -> null - - map_whole = (sensitive) -> null + - map_whole = (sensitive value) -> null - nested_block_set { # At least one attribute in this block is (or was) sensitive, @@ -6492,7 +6492,7 @@ func TestResourceChange_sensitiveVariable(t *testing.T) { ), ExpectedOutput: ` # test_instance.example must be replaced -/+ resource "test_instance" "example" { - ~ ami = (sensitive) # forces replacement + ~ ami = (sensitive value) # forces replacement id = "i-02ae66f368e8518a9" ~ nested_block_set { # forces replacement @@ -6524,7 +6524,7 @@ func TestResourceChange_sensitiveVariable(t *testing.T) { ), ExpectedOutput: ` # test_instance.example must be replaced -/+ resource "test_instance" "example" { - ~ ami = (sensitive) # forces replacement + ~ ami = (sensitive value) # forces replacement id = "i-02ae66f368e8518a9" } `, @@ -6567,7 +6567,7 @@ func TestResourceChange_sensitiveVariable(t *testing.T) { ExpectedOutput: ` # test_instance.example must be replaced -/+ resource "test_instance" "example" { ~ conn_info = { # forces replacement - ~ password = (sensitive) + ~ password = (sensitive value) # (1 unchanged attribute hidden) } id = "i-02ae66f368e8518a9" @@ -6824,7 +6824,7 @@ func TestOutputChanges(t *testing.T) { }, ` ~ a = 1 -> 2 - ~ b = (sensitive) + ~ b = (sensitive value) ~ c = false -> true`, }, } diff --git a/internal/repl/format.go b/internal/repl/format.go index fbdd44f58194..c65ad048b3b3 100644 --- a/internal/repl/format.go +++ b/internal/repl/format.go @@ -18,7 +18,7 @@ func FormatValue(v cty.Value, indent int) string { return "(known after apply)" } if v.HasMark(marks.Sensitive) { - return "(sensitive)" + return "(sensitive value)" } if v.IsNull() { ty := v.Type() diff --git a/internal/repl/format_test.go b/internal/repl/format_test.go index d7577135585c..31843bbe010b 100644 --- a/internal/repl/format_test.go +++ b/internal/repl/format_test.go @@ -171,8 +171,8 @@ EOT_`, `toset([])`, }, { - cty.StringVal("sensitive value").Mark(marks.Sensitive), - "(sensitive)", + cty.StringVal("a sensitive value").Mark(marks.Sensitive), + "(sensitive value)", }, } diff --git a/website/docs/language/expressions/function-calls.mdx b/website/docs/language/expressions/function-calls.mdx index dc870173c1e8..a590b6e87ce0 100644 --- a/website/docs/language/expressions/function-calls.mdx +++ b/website/docs/language/expressions/function-calls.mdx @@ -63,11 +63,11 @@ the `keys()` function will result in a list that is sensitive: ```shell > local.baz { - "a" = (sensitive) + "a" = (sensitive value) "b" = "dog" } > keys(local.baz) -(sensitive) +(sensitive value) ``` ## When Terraform Calls Functions diff --git a/website/docs/language/expressions/references.mdx b/website/docs/language/expressions/references.mdx index 1709b60fd23a..e3325b8c7f14 100644 --- a/website/docs/language/expressions/references.mdx +++ b/website/docs/language/expressions/references.mdx @@ -292,7 +292,7 @@ Note that unlike `count`, splat expressions are _not_ directly applicable to res When defining the schema for a resource type, a provider developer can mark certain attributes as _sensitive_, in which case Terraform will show a -placeholder marker `(sensitive)` instead of the actual value when rendering +placeholder marker `(sensitive value)` instead of the actual value when rendering a plan involving that attribute. A provider attribute marked as sensitive behaves similarly to an diff --git a/website/docs/language/functions/nonsensitive.mdx b/website/docs/language/functions/nonsensitive.mdx index df3186d18dba..7518eb2aa03f 100644 --- a/website/docs/language/functions/nonsensitive.mdx +++ b/website/docs/language/functions/nonsensitive.mdx @@ -91,11 +91,11 @@ the local value `mixed_content`, with a valid JSON string assigned to ``` > var.mixed_content_json -(sensitive) +(sensitive value) > local.mixed_content -(sensitive) +(sensitive value) > local.mixed_content["password"] -(sensitive) +(sensitive value) > nonsensitive(local.mixed_content["username"]) "zqb" > nonsensitive("clear") diff --git a/website/docs/language/functions/sensitive.mdx b/website/docs/language/functions/sensitive.mdx index b3a3bf220d8d..e974f3ec1bcc 100644 --- a/website/docs/language/functions/sensitive.mdx +++ b/website/docs/language/functions/sensitive.mdx @@ -34,9 +34,9 @@ because they may be exposed in other ways outside of Terraform's control. ``` > sensitive(1) -(sensitive) +(sensitive value) > sensitive("hello") -(sensitive) +(sensitive value) > sensitive([]) -(sensitive) +(sensitive value) ``` diff --git a/website/docs/language/values/outputs.mdx b/website/docs/language/values/outputs.mdx index 9b0fe88f0e3a..708157f0581e 100644 --- a/website/docs/language/values/outputs.mdx +++ b/website/docs/language/values/outputs.mdx @@ -159,7 +159,7 @@ Terraform will perform the following actions: # test_instance.x will be created + resource "test_instance" "x" { - + some_attribute = (sensitive) + + some_attribute = (sensitive value) } Plan: 1 to add, 0 to change, 0 to destroy. diff --git a/website/docs/language/values/variables.mdx b/website/docs/language/values/variables.mdx index 8fcc1e4962fb..9ec218a729d9 100644 --- a/website/docs/language/values/variables.mdx +++ b/website/docs/language/values/variables.mdx @@ -218,8 +218,8 @@ Terraform will perform the following actions: # some_resource.a will be created + resource "some_resource" "a" { - + name = (sensitive) - + address = (sensitive) + + name = (sensitive value) + + address = (sensitive value) } Plan: 1 to add, 0 to change, 0 to destroy. @@ -262,7 +262,7 @@ If a resource attribute is used as, or part of, the provider-defined resource id + resource "random_pet" "animal" { + id = (known after apply) + length = 2 - + prefix = (sensitive) + + prefix = (sensitive value) + separator = "-" }