Unwanted changes in sensitive value when running terraform plan

[PatriQ1414]

Terraform Version

Terraform v1.2.7

Terraform Configuration Files

...terraform config...

Debug Output

NA

Expected Behavior

No changes

Actual Behavior

local_file.ssh_key will be updated in-place

~ resource "local_file" "ssh_key" {
id = "e18093413cXXXXXXXXXXXXXXXXXXXXXX"
# (10 unchanged attributes hidden)
}

tls_private_key.pk will be updated in-place

~ resource "tls_private_key" "pk" {
id = "97f281183dce4cf6d9425bXXXXXXXXXXXXXXX"
# Warning: this attribute value will no longer be marked as sensitive
# after applying this change. The value is unchanged.
~ private_key_openssh = (sensitive value)
# Warning: this attribute value will no longer be marked as sensitive
# after applying this change. The value is unchanged.
~ private_key_pem = (sensitive value)
# Warning: this attribute value will no longer be marked as sensitive
# after applying this change. The value is unchanged.
~ private_key_pem_pkcs8 = (sensitive value)
# (7 unchanged attributes hidden)
}

module.compute.aws_iam_access_key.data_mig will be updated in-place

~ resource "aws_iam_access_key" "data_mig" {
id = "AKXXXXXXXXXXXXXXXXXXX"
# Warning: this attribute value will no longer be marked as sensitive
# after applying this change. The value is unchanged.
~ secret = (sensitive value)
# Warning: this attribute value will no longer be marked as sensitive
# after applying this change. The value is unchanged.
~ ses_smtp_password_v4 = (sensitive value)
# (3 unchanged attributes hidden)
}

module.compute.aws_secretsmanager_secret_version.data_mig_pass will be updated in-place

~ resource "aws_secretsmanager_secret_version" "data_mig_pass" {
id = "arn:aws:secretsmanager:eu-west-1:1112223334444secret:User-XXXXXXX-XXXXXX-XXXXX1"
# Warning: this attribute value will no longer be marked as sensitive
# after applying this change. The value is unchanged.
~ secret_binary = (sensitive value)
# (5 unchanged attributes hidden)
}

module.compute.aws_secretsmanager_secret_version.db_main_password["0"] will be updated in-place

~ resource "aws_secretsmanager_secret_version" "db_main_password" {
id = "arn:aws:secretsmanager:eu-west-1:1112223334444:secret:Password-XXXX-XXXXX-XXXXXX"
# Warning: this attribute value will no longer be marked as sensitive
# after applying this change. The value is unchanged.
~ secret_binary = (sensitive value)
# (5 unchanged attributes hidden)
}

module.compute.aws_sns_topic_subscription.user will be created

• resource "aws_sns_topic_subscription" "user" {
  • arn = (known after apply)
  • confirmation_timeout_in_minutes = 1
  • confirmation_was_authenticated = (known after apply)
  • endpoint = "user@email.com"
  • endpoint_auto_confirms = false
  • filter_policy_scope = (known after apply)
  • id = (known after apply)
  • owner_id = (known after apply)
  • pending_confirmation = (known after apply)
  • protocol = "email"
  • raw_message_delivery = false
  • topic_arn = "arn:aws:sns:eu-west-1:11112222233334444:XXXXXXXXXXXXXX
    }

module.compute.random_password.db_main_password["0"] will be updated in-place

~ resource "random_password" "db_main_password" {
# Warning: this attribute value will no longer be marked as sensitive
# after applying this change. The value is unchanged.
~ bcrypt_hash = (sensitive value)
id = "none"
# Warning: this attribute value will no longer be marked as sensitive
# after applying this change. The value is unchanged.
~ result = (sensitive value)
# (10 unchanged attributes hidden)
}

module.loadbalancer.aws_acm_certificate.public["0"] will be updated in-place

~ resource "aws_acm_certificate" "public" {
- certificate_authority_arn = "" -> null
- early_renewal_duration = "" -> null
id = "arn:aws:acm:eu-west-1:111222333344444:certificate/XXXXXXXXX-XXXXXXXXX"
# (15 unchanged attributes hidden)

    # (1 unchanged block hidden)
}

module.network.aws_iam_access_key.users will be updated in-place

~ resource "aws_iam_access_key" "users" {
id = "AKXXXXXXXXXXXXXXXXXXXXX"
# Warning: this attribute value will no longer be marked as sensitive
# after applying this change. The value is unchanged.
~ secret = (sensitive value)
# Warning: this attribute value will no longer be marked as sensitive
# after applying this change. The value is unchanged.
~ ses_smtp_password_v4 = (sensitive value)
# (3 unchanged attributes hidden)
}

module.network.aws_secretsmanager_secret_version.user will be updated in-place

~ resource "aws_secretsmanager_secret_version" "user" {
id = "arn:aws:secretsmanager:eu-west-1:1112223333444444:secret:user-XXXXXXXXXXXXXXXXXXXXXX"
# Warning: this attribute value will no longer be marked as sensitive
# after applying this change. The value is unchanged.
~ secret_binary = (sensitive value)
# (5 unchanged attributes hidden)
}

module.network.dome9_cloudaccount_aws.main[0] will be updated in-place

~ resource "dome9_cloudaccount_aws" "main" {
id = "6cb67097-af94-4642-ac25-b5bb40442e7a"
name = "UK-SITS-UAL-Prod"
# (8 unchanged attributes hidden)

  ~ credentials {
      - api_key      = "" -> null
      - iam_user     = "" -> null
      # Warning: this attribute value will no longer be marked as sensitive
      # after applying this change. The value is unchanged.
      ~ secret       = (sensitive value)
        # (3 unchanged attributes hidden)
    }

    # (1 unchanged block hidden)
}

Steps to Reproduce

terraform init
terraform plan
terraform apply

Additional Context

This only comes up as a warning and doesn't actually change anything

References

No

[jbardin]

Hi @PatriQ1414,

The version of Terraform you are using is quite old, and there have been many bugs fixed and improvements made since then.

If you can replicate the issue with a current Terraform release, please create a minimal example demonstrating the issue, including the configuration and steps to reproduce.

[jbardin]

Since we have not heard back in a while I'm going to close the issue. If you have any updates regarding the issue, feel free to open a new issue with the requested information. If you have more questions, you can also use the community forum where there are more people ready to help.

Thanks!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.