Set secret and ses_smtp_password to sensitive

[joshk0]

According to article, we should stop focusing efforts on encrypting state values with PGP keys and instead mark fields as sensitive. According to the article, the effort should be spent instead on protecting state buckets and our team intends to move in this direction.

Therefore, I've gone and set both attributes to sensitive and removed the deprecation notice recommending using the pgp_key technique.

Since people may disagree, I haven't gone so far as to remove the pgp_key support. I think it should remain for as long as the maintainers want to promote people using this feature and as long as it doesn't seem contrarian compared to official Hashicorp doctrine.

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Release note for CHANGELOG:

Un-deprecated the `secret` output attribute of `aws_iam_access_key`, and marked
the `secret` and `ses_smtp_password` attributes as `sensitive` instead, according
to [Terraform best practice](https://www.terraform.io/docs/extend/best-practices/sensitive-state.html).
`pgp_key` attribute remains usable and will continue to have the same behavior.

Output from acceptance testing:

▶ make testacc TESTARGS='-run=TestAccAWSAccess*'                   
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./... -v -count 1 -parallel 20 -run=TestAccAWSAccess* -timeout 120m
?   	github.com/terraform-providers/terraform-provider-aws	[no test files]
=== RUN   TestAccAWSAccessKey_basic
=== PAUSE TestAccAWSAccessKey_basic
=== RUN   TestAccAWSAccessKey_encrypted
=== PAUSE TestAccAWSAccessKey_encrypted
=== RUN   TestAccAWSAccessKey_inactive
=== PAUSE TestAccAWSAccessKey_inactive
=== CONT  TestAccAWSAccessKey_basic
=== CONT  TestAccAWSAccessKey_inactive
=== CONT  TestAccAWSAccessKey_encrypted
--- PASS: TestAccAWSAccessKey_basic (15.29s)
--- PASS: TestAccAWSAccessKey_encrypted (15.33s)
--- PASS: TestAccAWSAccessKey_inactive (26.03s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	27.965s
testing: warning: no tests to run
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws/internal/flatmap	0.352s [no tests to run]
testing: warning: no tests to run
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws/internal/keyvaluetags	0.223s [no tests to run]
...

[joshk0]

Additional Testing: After replacing the provider with the modified one I compiled, here is what the plan looks like:

  # aws_iam_access_key.abcdef is tainted, so must be replaced
-/+ resource "aws_iam_access_key" "abcdef" {
      + encrypted_secret  = (known after apply)
      ~ id                = "AKIAY3WDEADBEEFQH2EU" -> (known after apply)
      + key_fingerprint   = (known after apply)
      ~ secret            = (sensitive value)
      ~ ses_smtp_password = (sensitive value)
      ~ status            = "Active" -> (known after apply)
        user              = "abcdef"
    }

Before, secret and ses_smtp_password were visible in the clear.

[joshk0]

@bflad
Could I request triage of this ticket? I'm not sure who else to ask but have observed many other PRs filed and merged after mine was originally filed. I am eager to do any legwork that is required to make the process easy for you. Please let me know and thanks.

[gdavison]

Thank you for this, @joshk0. We will be merging this for the next release, expected late next week, though the schedule may be affected by AWS re:Invent

[ghost]

This has been released in version 2.41.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!