search

dikhan / terraform-provider-openapi

OpenAPI Terraform Provider that configures itself at runtime with the resources exposed by the service provider (defined in a swagger file)
Apache License 2.0
275 stars 48 forks source link

Plugin should not log payload from resource API to prevent printing sensitive props #242

Closed lillchan closed 4 years ago

lillchan commented 4 years ago

Describe the bug

The OpenAPI Terraform provider should not log the payload received from a resource provider's API in case there are secrets included in the response.

To Reproduce

Run a Terraform command with debugging enabled (for example, TF_LOG=DEBUG terraform refresh) on a tf file with a resource that has sensitive properties returned by the resource API.

Example:

2020-06-03T15:29:58.471-0700 [DEBUG] plugin.terraform-provider-openapi: 2020/06/03 15:29:58 [DEBUG] GET 'resource_v1' response payload: map[string]interface {}{"sensitive_property":"secret_value", "id": "some_id"}

Expected behaviour

Scenario:
Given a tf file containing resources with sensitive properties
When running the file in debug mode (eg: TF_LOG=DEBUG terraform refresh)
Then the OpenAPI provider plugin should not log the resource API's response payload in case sensitive properties are returned

Checklist (for admin only)

Don't forget to go through the checklist to make sure the issue is created properly: