A new optional block is added to both the shell_script data source and managed resource. This block, called sensitive_environment functions exactly the same as environment, except it is marked as sensitive and any variables in the map will not be printed to the console (both in DEBUG and non DEBUG). All sensitive values are replaced with "**" if they would have otherwise been printed. This makes the provider work better with secrets that you don't want in the state file or leaked in the plan.
Besides this new feature, there was some general cleanup work to the shell_script resource. As part of the emphasis on secrets management, state is no longer printed before and after an execution. You can still print the environment if you want to debug by using a normal CLI command like "printenv". Update() was simplified - the only thing that gets saved between runs is the output (previously, the old environment was saved but didnt do anything anyways).
This closes issue #22 and pull request #38 .
A new optional block is added to both the shell_script data source and managed resource. This block, called
sensitive_environment
functions exactly the same asenvironment
, except it is marked as sensitive and any variables in the map will not be printed to the console (both in DEBUG and non DEBUG). All sensitive values are replaced with "**" if they would have otherwise been printed. This makes the provider work better with secrets that you don't want in the state file or leaked in the plan.Consider the following code snippet:
If this were to be applied, the following would appear in the logs:
Besides this new feature, there was some general cleanup work to the shell_script resource. As part of the emphasis on secrets management, state is no longer printed before and after an execution. You can still print the environment if you want to debug by using a normal CLI command like "printenv".
Update()
was simplified - the only thing that gets saved between runs is the output (previously, the old environment was saved but didnt do anything anyways).