Skip to content

Commit bf239bb

Browse files
authored
fix: Ensure that API key and secret are not shown in the Terrafom plan output
I've been testing this module and I've realized that the values for `aqua_api_key` and `aqua_api_secret` are being shown in the Terraform plan output when the `single/lambda` module is used. This is not an issue on the `single/trigger` module as these variables are marked as sensitive there and thus not shown. Before: ``` # module.aqua_aws_onboarding.module.single[0].module.lambda.aws_lambda_invocation.generate_volscan_external_id_function will be created + resource "aws_lambda_invocation" "generate_volscan_external_id_function" { + function_name = (known after apply) + id = (known after apply) + input = jsonencode( { + ApiUrl = "..." + AquaApiKey = <plaintext_api_key> + AquaSecretKey = <plaintext_api_secret> + AutoConnectApiUrl = "..." } ) + lifecycle_scope = "CREATE_ONLY" + qualifier = "$LATEST" + result = (known after apply) + terraform_key = "tf" + triggers = (known after apply) } ``` After: ``` # module.aqua_aws_onboarding.module.single[0].module.lambda.aws_lambda_invocation.generate_volscan_external_id_function will be created + resource "aws_lambda_invocation" "generate_volscan_external_id_function" { + function_name = (known after apply) + id = (known after apply) + input = (sensitive value) + lifecycle_scope = "CREATE_ONLY" + qualifier = "$LATEST" + result = (known after apply) + terraform_key = "tf" + triggers = (known after apply) } ``` We use automated workflows to deploy Terraform code on GitHub, as such, we need to ensure that these values remain hidden. Let me know what you think, thanks. ``` Terraform v1.11.4 aquasecurity/onboarding/aws v0.2.2 hashicorp/aws v5.57.0 hashicorp/http v3.4.5 hashicorp/external v2.3.4 hashicorp/archive v2.4.2 hashicorp/random v3.6.3 hashicorp/time v0.13.0 ```
1 parent 0f24b8b commit bf239bb

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

modules/single/modules/lambda/variables.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,13 @@ variable "random_id" {
88
variable "aqua_api_key" {
99
description = "Aqua API Key"
1010
type = string
11+
sensitive = true
1112
}
1213

1314
variable "aqua_api_secret" {
1415
description = "Aqua API Secret"
1516
type = string
17+
sensitive = true
1618
}
1719

1820
variable "aqua_volscan_aws_account_id" {

0 commit comments

Comments
 (0)