provider/aws: Hash the admin password of AWS directory services in statefile

builtin/providers/aws/resource_aws_directory_service_directory.go

@@ -1,6 +1,8 @@
 package aws
 
 import (
+	"crypto/sha256"
+	"encoding/hex"
 	"fmt"
 	"log"
 	"time"
@@ -26,16 +28,23 @@ func resourceAwsDirectoryServiceDirectory() *schema.Resource {
 		Update: resourceAwsDirectoryServiceDirectoryUpdate,
 		Delete: resourceAwsDirectoryServiceDirectoryDelete,
 
+		SchemaVersion: 1,
+		MigrateState:  resourceAwsDirectoryServiceDirectoryMigrateState,
+
 		Schema: map[string]*schema.Schema{
 			"name": &schema.Schema{
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
 			},
 			"password": &schema.Schema{
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
+				Type:      schema.TypeString,
+				Required:  true,
+				ForceNew:  true,
+				Sensitive: true,
+				StateFunc: func(v interface{}) string {
+					return directoryServicePasswordHashSha256(v.(string))
+				},
 			},
 			"size": &schema.Schema{
 				Type:     schema.TypeString,
@@ -487,3 +496,9 @@ func resourceAwsDirectoryServiceDirectoryDelete(d *schema.ResourceData, meta int
 
 	return nil
 }
+
+func directoryServicePasswordHashSha256(password string) string {
+	password_hash := sha256.Sum256([]byte(password))
+	hash_hex := hex.EncodeToString(password_hash[:])
+	return hash_hex
+}

builtin/providers/aws/resource_aws_directory_service_directory_migrate.go

@@ -0,0 +1,35 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func resourceAwsDirectoryServiceDirectoryMigrateState(
+	v int, is *terraform.InstanceState, meta interface{}) (*terraform.InstanceState, error) {
+
+	switch v {
+	case 0:
+		log.Println("[INFO] Found AWS Directory Service Directory State v0; migrating to v1")
+		return migrateDirectoryServiceStateV0toV1(is)
+	default:
+		return is, fmt.Errorf("Unexpected schema version: %d", v)
+	}
+}
+
+func migrateDirectoryServiceStateV0toV1(is *terraform.InstanceState) (*terraform.InstanceState, error) {
+	if is.Empty() {
+		log.Println("[DEBUG] Empty InstanceState; nothing to migrate.")
+		return is, nil
+	}
+
+	log.Printf("[DEBUG] Attributes before migration %#v", is.Attributes)
+
+	// Replace password with password hash
+	is.Attributes["password"] = directoryServicePasswordHashSha256(is.Attributes["password"])
+
+	log.Printf("[DEBUG] Attributes after migration: %#v", is.Attributes)
+	return is, nil
+}

builtin/providers/aws/resource_aws_directory_service_directory_migrate_test.go

@@ -0,0 +1,43 @@
+package aws
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestResourceAwsDirectoryServicesDirectoryMigrateState(t *testing.T) {
+	cases := map[string]struct {
+		StateVersion int
+		ID           string
+		Attributes   map[string]string
+		Expected     string
+		Meta         interface{}
+	}{
+		"v0_1": {
+			StateVersion: 0,
+			ID:           "d-abc123",
+			Attributes: map[string]string{
+				"password": "hunter2",
+			},
+			Expected: "f52fbd32b2b3b86ff88ef6c490628285f482af15ddcb29541f94bcf526a3f6c7",
+		},
+	}
+
+	for tn, tc := range cases {
+		is := &terraform.InstanceState{
+			ID:         tc.ID,
+			Attributes: tc.Attributes,
+		}
+		is, err := resourceAwsDirectoryServiceDirectoryMigrateState(
+			tc.StateVersion, is, tc.Meta)
+
+		if err != nil {
+			t.Fatalf("bad: %s, err: %#v", tn, err)
+		}
+
+		if is.Attributes["password"] != tc.Expected {
+			t.Fatalf("Bad password hash migration: %s\n\n expected %s", is.Attributes["password"], tc.Expected)
+		}
+	}
+}