diff --git a/internal/lang/funcs/sensitive.go b/internal/lang/funcs/sensitive.go index a08481762952..97703a4f1326 100644 --- a/internal/lang/funcs/sensitive.go +++ b/internal/lang/funcs/sensitive.go @@ -52,9 +52,6 @@ var NonsensitiveFunc = function.New(&function.Spec{ return args[0].Type(), nil }, Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) { - if args[0].IsKnown() && !args[0].HasMark(marks.Sensitive) { - return cty.DynamicVal, function.NewArgErrorf(0, "the given value is not sensitive, so this call is redundant") - } v, m := args[0].Unmark() delete(m, marks.Sensitive) // remove the sensitive marking return v.WithMarks(m), nil diff --git a/internal/lang/funcs/sensitive_test.go b/internal/lang/funcs/sensitive_test.go index 8d510cd8a1da..96e647d05348 100644 --- a/internal/lang/funcs/sensitive_test.go +++ b/internal/lang/funcs/sensitive_test.go @@ -130,16 +130,16 @@ func TestNonsensitive(t *testing.T) { ``, }, - // Passing a value that is already non-sensitive is an error, - // because this function should always be used with specific - // intention, not just as a "make everything visible" hammer. + // Passing a value that is already non-sensitive is not an error, + // as this function may be used with specific to ensure that all + // values are indeed non-sensitive { cty.NumberIntVal(1), - `the given value is not sensitive, so this call is redundant`, + ``, }, { cty.NullVal(cty.String), - `the given value is not sensitive, so this call is redundant`, + ``, }, // Unknown values may become sensitive once they are known, so we diff --git a/website/docs/language/functions/nonsensitive.mdx b/website/docs/language/functions/nonsensitive.mdx index 7518eb2aa03f..c25ba18432ab 100644 --- a/website/docs/language/functions/nonsensitive.mdx +++ b/website/docs/language/functions/nonsensitive.mdx @@ -73,10 +73,8 @@ due to an inappropriate call to `nonsensitive` in your module, that's a bug in your module and not a bug in Terraform itself. **Use this function sparingly and only with due care.** -`nonsensitive` will return an error if you pass a value that isn't marked -as sensitive, because such a call would be redundant and potentially confusing -or misleading to a future maintainer of your module. Use `nonsensitive` only -after careful consideration and with definite intent. +`nonsensitive` will make no changes to values that aren't marked as sensitive, even though such a call may be redundant and potentially confusing. +Use `nonsensitive` only after careful consideration and with definite intent. Consider including a comment adjacent to your call to explain to future maintainers what makes the usage safe and thus what invariants they must take