IntenseWebs/opentofu
3
0
Fork 0
mirror of https://github.com/opentofu/opentofu.git synced 2025-02-25 18:45:20 -06:00
Code Issues Packages Projects Releases Wiki Activity

store non-root sensitive outputs in state

Browse Source 
Module outputs are evaluated from state, so in order to have detailed
information about sensitivity from non-root module outputs, we need to
store the value along with all sensitive marks. This aligns with the
usage of state being the in-memory store for other temporary values like
locals and variables.
This commit is contained in:
James Bardin 2023-03-20 13:27:53 -04:00
parent 4fff0bd857
commit 425c6bead2
1 changed files with 6 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
internal/terraform/node_output.go
View File

@ -605,18 +605,13 @@ func (n *NodeApplyableOutput) setValue(state *states.SyncState, changes *plans.C
// out here and then we'll save the real unknown value in the planned
// changeset, if we have one on this graph walk.
log.Printf("[TRACE] setValue: Saving value for %s in state", n.Addr)
sensitive := n.Config.Sensitive
unmarkedVal, valueMarks := val.UnmarkDeep()
// If the evaluated value contains sensitive marks, the output has no
// choice but to declare itself as "sensitive".
for mark := range valueMarks {
if mark == marks.Sensitive {
sensitive = true
break
}
// non-root outputs need to keep sensitive marks for evaluation, but are
// not serialized.
if n.Addr.Module.IsRoot() {
val, _ = val.UnmarkDeep()
val = cty.UnknownAsNull(val)
}
stateVal := cty.UnknownAsNull(unmarkedVal)
state.SetOutputValue(n.Addr, stateVal, sensitive)
state.SetOutputValue(n.Addr, val, n.Config.Sensitive)
}