Skip to content

fix: Ensure that API key and secret are not shown in the Terrafom plan output#13

Merged
semyonmor merged 1 commit intoaquasecurity:mainfrom
diglesias-te:patch-1
May 21, 2025
Merged

fix: Ensure that API key and secret are not shown in the Terrafom plan output#13
semyonmor merged 1 commit intoaquasecurity:mainfrom
diglesias-te:patch-1

Conversation

@diglesias-te
Copy link
Copy Markdown
Contributor

This fixes #12

I've been testing this module and I've realized that the values for aqua_api_key and aqua_api_secret are being shown in the Terraform plan output when the single/lambda module is used.

This is not an issue on the single/trigger module as these variables are marked as sensitive there and thus not shown.

Before:

# module.aqua_aws_onboarding.module.single[0].module.lambda.aws_lambda_invocation.generate_volscan_external_id_function will be created
  + resource "aws_lambda_invocation" "generate_volscan_external_id_function" {
      + function_name   = (known after apply)
      + id              = (known after apply)
      + input           = jsonencode(
            {
              + ApiUrl            = "..."
              + AquaApiKey        = <plaintext_api_key>
              + AquaSecretKey     = <plaintext_api_secret>
              + AutoConnectApiUrl = "..."
            }
        )
      + lifecycle_scope = "CREATE_ONLY"
      + qualifier       = "$LATEST"
      + result          = (known after apply)
      + terraform_key   = "tf"
      + triggers        = (known after apply)
    }

After:

  # module.aqua_aws_onboarding.module.single[0].module.lambda.aws_lambda_invocation.generate_volscan_external_id_function will be created
  + resource "aws_lambda_invocation" "generate_volscan_external_id_function" {
      + function_name   = (known after apply)
      + id              = (known after apply)
      + input           = (sensitive value)
      + lifecycle_scope = "CREATE_ONLY"
      + qualifier       = "$LATEST"
      + result          = (known after apply)
      + terraform_key   = "tf"
      + triggers        = (known after apply)
    }

We use automated workflows to deploy Terraform code on GitHub, as such, we need to ensure that these values remain hidden. Let me know what you think, thanks.

…n output

I've been testing this module and I've realized that the values for `aqua_api_key` and `aqua_api_secret` are being shown in the Terraform plan output when the `single/lambda` module is used.

This is not an issue on the `single/trigger` module as these variables are marked as sensitive there and thus not shown.

Before:
```
# module.aqua_aws_onboarding.module.single[0].module.lambda.aws_lambda_invocation.generate_volscan_external_id_function will be created
  + resource "aws_lambda_invocation" "generate_volscan_external_id_function" {
      + function_name   = (known after apply)
      + id              = (known after apply)
      + input           = jsonencode(
            {
              + ApiUrl            = "..."
              + AquaApiKey        = <plaintext_api_key>
              + AquaSecretKey     = <plaintext_api_secret>
              + AutoConnectApiUrl = "..."
            }
        )
      + lifecycle_scope = "CREATE_ONLY"
      + qualifier       = "$LATEST"
      + result          = (known after apply)
      + terraform_key   = "tf"
      + triggers        = (known after apply)
    }
```

After:
```
  # module.aqua_aws_onboarding.module.single[0].module.lambda.aws_lambda_invocation.generate_volscan_external_id_function will be created
  + resource "aws_lambda_invocation" "generate_volscan_external_id_function" {
      + function_name   = (known after apply)
      + id              = (known after apply)
      + input           = (sensitive value)
      + lifecycle_scope = "CREATE_ONLY"
      + qualifier       = "$LATEST"
      + result          = (known after apply)
      + terraform_key   = "tf"
      + triggers        = (known after apply)
    }
```

We use automated workflows to deploy Terraform code on GitHub, as such, we need to ensure that these values remain hidden.
Let me know what you think, thanks.

```
Terraform v1.11.4
aquasecurity/onboarding/aws v0.2.2
hashicorp/aws v5.57.0
hashicorp/http v3.4.5
hashicorp/external v2.3.4
hashicorp/archive v2.4.2
hashicorp/random v3.6.3
hashicorp/time v0.13.0
```
@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Apr 25, 2025

CLA assistant check
All committers have signed the CLA.

@semyonmor semyonmor merged commit 2b523fd into aquasecurity:main May 21, 2025
1 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug: Sensitive values API key and secret are being shown in the Terraform plan output

4 participants