IntenseWebs/opentofu
3
0
Fork 0
mirror of https://github.com/opentofu/opentofu.git synced 2025-02-25 18:45:20 -06:00
Code Issues Packages Projects Releases Wiki Activity

store non-root sensitive outputs in state

Browse Source 
Module outputs are evaluated from state, so in order to have detailed
information about sensitivity from non-root module outputs, we need to
store the value along with all sensitive marks. This aligns with the
usage of state being the in-memory store for other temporary values like
locals and variables.
This commit is contained in:
James Bardin 2023-03-20 13:27:53 -04:00
parent 4fff0bd857
commit 425c6bead2
1 changed files with 6 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
internal/terraform/node_output.go
View File

@ -605,18 +605,13 @@ func (n *NodeApplyableOutput) setValue(state *states.SyncState, changes *plans.C
// out here and then we'll save the real unknown value in the planned // out here and then we'll save the real unknown value in the planned
// changeset, if we have one on this graph walk. // changeset, if we have one on this graph walk.
log.Printf("[TRACE] setValue: Saving value for %s in state", n.Addr) log.Printf("[TRACE] setValue: Saving value for %s in state", n.Addr)
sensitive := n.Config.Sensitive
unmarkedVal, valueMarks := val.UnmarkDeep()
// If the evaluated value contains sensitive marks, the output has no // non-root outputs need to keep sensitive marks for evaluation, but are
// choice but to declare itself as "sensitive". // not serialized.
for mark := range valueMarks { if n.Addr.Module.IsRoot() {
if mark == marks.Sensitive { val, _ = val.UnmarkDeep()
sensitive = true val = cty.UnknownAsNull(val)
break
}
} }
stateVal := cty.UnknownAsNull(unmarkedVal) state.SetOutputValue(n.Addr, val, n.Config.Sensitive)
state.SetOutputValue(n.Addr, stateVal, sensitive)
} }