Hide CloudFormation template sensitive parameters

[ghost]

This issue was originally opened by @BartekChojnacki as hashicorp/terraform#26288. It was migrated here as a result of the provider split. The original body of the issue is below.

---

Hello,

When I want to run cloudformation stack from Terraform and this stack has sensitive parameters, which are set up in cloudformation template as ( SecretString: Type: 'String' NoEcho: true ) there are no possibility to make sensitive section parameters = {} / parameter_overrides = { } and all sensitive parameters are visible in terraform plan.

Current Terraform Version

Terraform v0.13.0
+ provider registry.terraform.io/-/aws v3.7.0
+ provider registry.terraform.io/-/template v2.1.2
+ provider registry.terraform.io/hashicorp/aws v3.7.0
+ provider registry.terraform.io/hashicorp/template v2.1.2

Use-cases

# module.iam_module.aws_cloudformation_stack_set_instance.smsminstance["aws-network-non-prod"] will be updated in-place ~ resource "aws_cloudformation_stack_set_instance" "examample_instance" { account_id = "example_account" id = "tfe-stackset-sm-deployer,016091306659,eu-west-1" ~ parameter_overrides = { ~ "SecretString" = "****" -> jsonencode( { + SECRET_KEY = "SECRET_KEY_VALUE"

Proposal

There should be an option to make parameters {} section for resource "aws_cloudformation_stack_set" and parameter_overrides = {} for resource "aws_cloudformation_stack_set_instance" sensitive, and hide it on the plan if it is needed. Especially when the input parameters of the cloudformation template are sensitive.

[anGie44]

Hi @BartekChojnacki, thank you for creating this issue! Dropping a note here to reference an implementation consideration for marking a TypeMap and it's attributes as Sensitive: #15157 (comment)

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.