A password from grafana_user resource is stored in state as plain text

[paweloczadly]

Terraform Version

$ terraform -v
Terraform v0.14.5
+ provider registry.terraform.io/grafana/grafana v1.8.1

Affected Resource

grafana_user

Terraform Configuration Files

resource "grafana_user" "user" {
  email    = "user@example.com"
  login    = "user@example.com"
  password = "my-password"
}

Debug Output

n/a

Panic Output

n/a

Expected Behavior

Password is not stored in the state file in the plain text.

Actual Behavior

Password is required, but the doc mentioned it's optional. Moreover it is stored in the state file in the plain text which is insecurity and generally a very bad practice.

Steps to Reproduce

1. terraform init
2. terraform apply

Important Factoids

No.

References

n/a

[nikosmeds]

Hey @paweloczadly 👋

The docs have been fixed in #187.

Regarding the password parameter, it is correctly set as Sensitive.

terraform-provider-grafana/grafana/resource_user.go

Lines 47 to 52 in a3ad018

	"password": {
	Type: schema.TypeString,
	Required: true,
	Sensitive: true,
	Description: "The password for the Grafana user.",
	},

Terraform state configurations are outside the scope of this provider, see

• https://www.terraform.io/docs/language/state/sensitive-data.html
• https://learn.hashicorp.com/tutorials/terraform/sensitive-variables

Going to close this issue, but please re-open if necessary.