Sensitive values showing in plan

[tesharp]

Terraform Version

Terraform v0.12.13

Terraform Configuration Files

resource "azurerm_kubernetes_cluster" "aks" {
  name                            = "${var.name}-aks"
  location                        = azurerm_resource_group.aks.location
  resource_group_name             = azurerm_resource_group.aks.name
  dns_prefix                      = var.name
  kubernetes_version              = var.kubernetes_version
  api_server_authorized_ip_ranges = var.api_server_authorized_ip_ranges

 ...
}

Expected Behavior

When making a change and running terraform plan the plan should hide all sensitive values.

Actual Behavior

Running terraform plan on azurerm_kubernetes_cluster shows the kube_admin_config and kube_config sensitive values in clear text in plan. The kube_admin_config_raw is shown as sensitive value though. kube_admin_config[].password should be sensitive according to code (https://github.com/terraform-providers/terraform-provider-azurerm/blob/master/azurerm/resource_arm_kubernetes_cluster.go#L558)

Plan output:

  ~ resource "azurerm_kubernetes_cluster" "aks" {
        api_server_authorized_ip_ranges = []
        dns_prefix                      = "xxxx"
        enable_pod_security_policy      = true
        fqdn                            = "xxxx.azmk8s.io"
        id                              = "/subscriptions/xxxx/resourcegroups/xxxx-rg/providers/Microsoft.ContainerService/managedClusters/xxxx"
        kube_admin_config               = [
            {
                client_certificate     = "xxxxx"
                client_key             = "xxxxx"
                cluster_ca_certificate = "xxxxx"
                host                   = "https://xxxx.azmk8s.io:443"
                password               = "xxxxx"
                username               = "clusterAdmin_xxxx-rg_xxxx"
            },
        ]
        kube_admin_config_raw           = (sensitive value)
        kube_config                     = [
            {
                client_certificate     = ""
                client_key             = ""
                cluster_ca_certificate = "xxxx"
                host                   = "https://xxxx.azmk8s.io:443"
                password               = ""
                username               = "clusterUser_xxxx-rg_xxxx"
            },
        ]
        kube_config_raw                 = (sensitive value)

Steps to Reproduce

Make a change and run terraform plan. Output should show the sensitive value in clear text.

[hashibot]

Hello! 🤖

This issue seems to be covering the same problem or request as hashicorp/terraform-plugin-sdk#201, so we're going to close it just to consolidate the discussion over there. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.