From a2e04949be07c3e30717c3dda3a42febc78b1b96 Mon Sep 17 00:00:00 2001 From: Damian Debkowski Date: Wed, 21 Sep 2022 10:24:34 -0700 Subject: [PATCH] fix: set secret variables to senitive (#272) --- docs/resources/account.md | 2 +- docs/resources/account_password.md | 2 +- docs/resources/auth_method_oidc.md | 2 +- docs/resources/credential_ssh_private_key.md | 4 ++-- docs/resources/credential_username_password.md | 2 +- internal/provider/resource_account.go | 2 +- internal/provider/resource_account_password.go | 2 +- internal/provider/resource_auth_method_oidc.go | 1 + internal/provider/resource_credential_ssh_private_key.go | 2 ++ internal/provider/resource_credential_username_password.go | 1 + 10 files changed, 12 insertions(+), 8 deletions(-) diff --git a/docs/resources/account.md b/docs/resources/account.md index c8cba5f4..cdcd0b5e 100644 --- a/docs/resources/account.md +++ b/docs/resources/account.md @@ -25,7 +25,7 @@ Deprecated: use `boundary_account_password` instead. - `description` (String) The account description. - `login_name` (String) The login name for this account. - `name` (String) The account name. Defaults to the resource name. -- `password` (String) The account password. Only set on create, changes will not be reflected when updating account. +- `password` (String, Sensitive) The account password. Only set on create, changes will not be reflected when updating account. ### Read-Only diff --git a/docs/resources/account_password.md b/docs/resources/account_password.md index 9829aa7c..5408f588 100644 --- a/docs/resources/account_password.md +++ b/docs/resources/account_password.md @@ -47,7 +47,7 @@ resource "boundary_account_password" "jeff" { - `description` (String) The account description. - `login_name` (String) The login name for this account. - `name` (String) The account name. Defaults to the resource name. -- `password` (String) The account password. Only set on create, changes will not be reflected when updating account. +- `password` (String, Sensitive) The account password. Only set on create, changes will not be reflected when updating account. ### Read-Only diff --git a/docs/resources/auth_method_oidc.md b/docs/resources/auth_method_oidc.md index d28c7bd9..446dc2af 100644 --- a/docs/resources/auth_method_oidc.md +++ b/docs/resources/auth_method_oidc.md @@ -27,7 +27,7 @@ The OIDC auth method resource allows you to configure a Boundary auth_method_oid - `callback_url` (String) The URL that should be provided to the IdP for callbacks. - `claims_scopes` (List of String) Claims scopes. - `client_id` (String) The client ID assigned to this auth method from the provider. -- `client_secret` (String) The secret key assigned to this auth method from the provider. Once set, only the hash will be kept and the original value can be removed from configuration. +- `client_secret` (String, Sensitive) The secret key assigned to this auth method from the provider. Once set, only the hash will be kept and the original value can be removed from configuration. - `client_secret_hmac` (String) The HMAC of the client secret returned by the Boundary controller, which is used for comparison after initial setting of the value. - `description` (String) The auth method description. - `disable_discovered_config_validation` (Boolean) Disables validation logic ensuring that the OIDC provider's information from its discovery endpoint matches the information here. The validation is only performed at create or update time. diff --git a/docs/resources/credential_ssh_private_key.md b/docs/resources/credential_ssh_private_key.md index d7909c6f..3ec1a5dc 100644 --- a/docs/resources/credential_ssh_private_key.md +++ b/docs/resources/credential_ssh_private_key.md @@ -50,14 +50,14 @@ resource "boundary_credential_ssh_private_key" "example" { ### Required - `credential_store_id` (String) ID of the credential store this credential belongs to. -- `private_key` (String) The private key associated with the credential. +- `private_key` (String, Sensitive) The private key associated with the credential. - `username` (String) The username associated with the credential. ### Optional - `description` (String) The description of the credential. - `name` (String) The name of the credential. Defaults to the resource name. -- `private_key_passphrase` (String) The passphrase of the private key associated with the credential. +- `private_key_passphrase` (String, Sensitive) The passphrase of the private key associated with the credential. ### Read-Only diff --git a/docs/resources/credential_username_password.md b/docs/resources/credential_username_password.md index 37ee56fd..6ea945ff 100644 --- a/docs/resources/credential_username_password.md +++ b/docs/resources/credential_username_password.md @@ -49,7 +49,7 @@ resource "boundary_credential_username_password" "example" { ### Required - `credential_store_id` (String) The credential store in which to save this username/password credential. -- `password` (String) The password of this username/password credential. +- `password` (String, Sensitive) The password of this username/password credential. - `username` (String) The username of this username/password credential. ### Optional diff --git a/internal/provider/resource_account.go b/internal/provider/resource_account.go index ae0208cb..4c53d2a4 100644 --- a/internal/provider/resource_account.go +++ b/internal/provider/resource_account.go @@ -60,7 +60,7 @@ func resourceAccount() *schema.Resource { Description: "The account password. Only set on create, changes will not be reflected when updating account.", Type: schema.TypeString, Optional: true, - + Sensitive: true, DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool { if d.Id() == "" { // This is a new resource do not suppress password diff diff --git a/internal/provider/resource_account_password.go b/internal/provider/resource_account_password.go index 10c5cdbe..0e88fa92 100644 --- a/internal/provider/resource_account_password.go +++ b/internal/provider/resource_account_password.go @@ -65,7 +65,7 @@ func resourceAccountPassword() *schema.Resource { Description: "The account password. Only set on create, changes will not be reflected when updating account.", Type: schema.TypeString, Optional: true, - + Sensitive: true, DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool { if d.Id() == "" { // This is a new resource do not suppress password diff diff --git a/internal/provider/resource_auth_method_oidc.go b/internal/provider/resource_auth_method_oidc.go index 03b8ddca..d7abc476 100644 --- a/internal/provider/resource_auth_method_oidc.go +++ b/internal/provider/resource_auth_method_oidc.go @@ -99,6 +99,7 @@ func resourceAuthMethodOidc() *schema.Resource { Description: "The secret key assigned to this auth method from the provider. Once set, only the hash will be kept and the original value can be removed from configuration.", Type: schema.TypeString, Optional: true, + Sensitive: true, }, authmethodOidcIssuerKey: { Description: "The issuer corresponding to the provider, which must match the issuer field in generated tokens.", diff --git a/internal/provider/resource_credential_ssh_private_key.go b/internal/provider/resource_credential_ssh_private_key.go index 1da05ada..f55786b2 100644 --- a/internal/provider/resource_credential_ssh_private_key.go +++ b/internal/provider/resource_credential_ssh_private_key.go @@ -62,6 +62,7 @@ func resourceCredentialSshPrivateKey() *schema.Resource { Description: "The private key associated with the credential.", Type: schema.TypeString, Required: true, + Sensitive: true, }, credentialSshPrivateKeyPrivateKeyHmacKey: { Description: "The private key hmac.", @@ -72,6 +73,7 @@ func resourceCredentialSshPrivateKey() *schema.Resource { Description: "The passphrase of the private key associated with the credential.", Type: schema.TypeString, Optional: true, + Sensitive: true, }, credentialSshPrivateKeyPassphraseHmacKey: { Description: "The private key passphrase hmac.", diff --git a/internal/provider/resource_credential_username_password.go b/internal/provider/resource_credential_username_password.go index 49616cf1..7a17c672 100644 --- a/internal/provider/resource_credential_username_password.go +++ b/internal/provider/resource_credential_username_password.go @@ -60,6 +60,7 @@ func resourceCredentialUsernamePassword() *schema.Resource { Description: "The password of this username/password credential.", Type: schema.TypeString, Required: true, + Sensitive: true, }, credentialUsernamePasswordPasswordHmacKey: { Description: "The password hmac.",