Sensitive value redaction in Terraform JSON output: unresolved behavior
0 reputation · 18 Aug 2020, 04:32 UTC
Goal
The objective is to prevent secrets from leaking when consuming a Terraform plan via terraform show -json, while preserving the ability for automated tools to parse the full plan.
Constraints
Terraform’s sensitive = true attribute only suppresses values in the default text output. The JSON representation, which is essential for CI/CD pipelines and third‑party tooling, still contains plaintext values. Existing automation expects the JSON to be fully populated, so any change to redact values would break downstream consumers.
Uncertainty
It is unclear whether Terraform should offer an opt‑in mechanism to redact sensitive fields in JSON, or whether the design decision to leave them exposed should remain. The trade‑off between security and usability is still debated within the community.
Questions
- Should Terraform redact sensitive values by default in
terraform show -json? - What mechanisms could allow selective redaction without breaking existing automation workflows?
- How can users explicitly opt into redaction of sensitive fields when consuming JSON output?
terraform