[Bug]: data ssm_parameter.value should not be sensitive

[elduds]

Terraform Core Version

all

AWS Provider Version

all

Affected Resource(s)

aws_ssm_parameter

Expected Behavior

the value attribute of https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter should not be marked as sensitive if the type of the parameter is String.

If the type is set to SecureString, assume the value to be sensitive.

Actual Behavior

This value is always marked as sensitive, regardless of type.

This makes planning and debugging far more difficult than it should be for no corresponding value / increase in security.

Relevant Error/Panic Output Snippet

❯ terraform plan
data.aws_ssm_parameter.not_sensitive: Reading...
data.aws_ssm_parameter.not_sensitive: Read complete after 1s [id=/parameter/that/is/not/sensitive]

Planning failed. Terraform encountered an error while generating this plan.

╷
│ Error: Output refers to sensitive values
│ 
│   on tf.tf line 5:
│    5: output "all" {
│ 
│ To reduce the risk of accidentally exporting sensitive data that was intended to be only internal, Terraform
│ requires that any root module output containing sensitive data be explicitly marked as sensitive, to confirm your
│ intent.
│ 
│ If you do intend to export this data, annotate the output value as sensitive by adding the following argument:
│     sensitive = true

Terraform Configuration Files

data "aws_ssm_parameter" "not_sensitive" {
  name = "/parameter/that/is/not/sensitive"
}

output "all" {
  value       = data.aws_ssm_parameter.not_sensitive.value
  sensitive   = false
  description = "My super-not-secret data"
}

Steps to Reproduce

attempt to plan the above tf code

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[ShathishWarmaS]

output "all" {
value = data.aws_ssm_parameter.not_sensitive.value
sensitive = true
}

sensitive = true to the output definition, you confirm that the output contains sensitive data and that you intend to export it. This prevents accidental exposure of sensitive information in Terraform outputs.

[elduds]

sensitive = true to the output definition, you confirm that the output contains sensitive data and that you intend to export it. This prevents accidental exposure of sensitive information in Terraform outputs.

But the output does not contain sensitive data, nor is it ever likely to contain sensitive data. That's what SecureString type is for.

[ShathishWarmaS]

output "all" {
value = data.aws_ssm_parameter.not_sensitive.value
ignore_changes = true
}

ignore_changes = true, you inform Terraform to ignore any modifications to the output value during plan and apply operations. This can help bypass the sensitivity check if you are certain that the output doesn't contain sensitive information.

data "aws_ssm_parameter" "not_sensitive" {
name = "/parameter/that/is/not/sensitive"
}

output "all" {
value = data.aws_ssm_parameter.not_sensitive.value
sensitive = false
description = "My super-not-secret data"
ignore_changes = true
}

[justinretzolk]

Hey @elduds 👋 Thank you for taking the time to raise this! In this case, the sensitivity is defined at the resource schema level. This is something that the plugin SDK does not currently support toggling dynamically based on something like whether the type is a String or SecureString.

Interestingly, I've found a feature request on the plugin SDK repository (hashicorp/terraform-plugin-sdk#736) for this exact thing (so much so that the example is precisely what you're calling out here). On that issue, a workaround is called out using the nonsensitive() function to instruct Terraform to remove the sensitive flag.

Given that this is an upstream limitation, and not a bug within the provider, I'll close this issue for now. If you feel I've done this in error, please do let me know.

[elduds]

Awesome, thanks @justinretzolk . I was unaware of nonsensitive() so will definitely give that a go in the meantime -- sounds like it does exactly what I need.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.