handling sensitive input variables

[bartekmo]

Passing input variables with sensitive flag (eg. filling var.fmg_integration.ums.api_key with data from secret manager or vault instead of static string from .tfvars) makes whole var.fmg_integration object sensitive. As a consequence everything derived from it gets this mark. Including local.deploy_function boolean. As sensitive variables cannot be used for loops deployment fails with error:

│ local.deploy_function has a sensitive value
│ 
│ Sensitive values, or values derived from sensitive values, cannot be used as for_each arguments. If used, the sensitive value could be exposed as a
│ resource instance key.

Please use nonsensitive() function to selectively clear the sensitive flag when calculating for_each/count local variables from inputs which potentially can be sensitive.

example breaking code:

data "google_secret_manager_secret_version" "fmg_api_key" {
  secret  = var.fmg_api_key_secret_name
  project = var.project
}

module "fortigate_asg" {
  source   = "github.com/fortinetdev/terraform-google-cloud-modules/modules/fortigate/fgt_asg_with_function"

  fmg_integration = {
    ums = {
      api_key             = data.google_secret_manager_secret_version.fmg_api_key.secret_data
    }
  }

}

[dux-fortinet]

Hi Bartek,

Thanks for pointing it out! This issue will be fixed in the next patch.

Regards,
Xinwei