Skip to content

fix: Do not expose output from build command in Docker #677

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

pawelpesz
Copy link
Contributor

Description

If dependencies build is performed using Docker, and additional Docker options are specified, and any of those options contain a sensitive value, the content of the archive file has also to be marked as sensitive, to avoid exposing these sensitive options in the Terraform plan. Unfortunately the external provider doesn't support marking output values as sensitive, so this workaround seems like an only viable solution.

Motivation and Context

Fixes #676.

Breaking Changes

None.

How Has This Been Tested?

  • I have updated at least one of the examples/* to demonstrate and validate my change(s)
  • I have tested and validated these changes using one or more of the provided examples/* projects
  • I have executed pre-commit run -a on my pull request

Sorry, something went wrong.

@pawelpesz
Copy link
Contributor Author

Hello @antonbabenko, I'd be extremely grateful if you could find time to review this. It's a one-liner 😄

@@ -49,7 +49,7 @@ data "external" "archive_prepare" {
resource "local_file" "archive_plan" {
count = var.create && var.create_package ? 1 : 0

content = data.external.archive_prepare[0].result.build_plan
content = var.build_in_docker ? sensitive(data.external.archive_prepare[0].result.build_plan) : data.external.archive_prepare[0].result.build_plan
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The best solution would be to hide values ONLY if there are secrets inside. Function issensitive became available in Terraform 1.8 but this module expects Terraform 1.0.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indeed, my first patch was using the issensitive function, but then I checked it only appeared in 1.8. Thank you @antonbabenko!

@antonbabenko antonbabenko changed the title fix: Do not expose sensitive Docker additional options fix: Do not expose output from build command in Docker May 16, 2025
@antonbabenko antonbabenko merged commit 75ee97d into terraform-aws-modules:master May 16, 2025
31 checks passed
antonbabenko pushed a commit that referenced this pull request May 16, 2025
## [7.20.3](v7.20.2...v7.20.3) (2025-05-16)

### Bug Fixes

* Do not expose output from build command in Docker ([#677](#677)) ([75ee97d](75ee97d))
@antonbabenko
Copy link
Member

This PR is included in version 7.20.3 🎉

@pawelpesz pawelpesz deleted the fix/sensitive-docker-options branch May 16, 2025 11:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Sensitive values in Docker additional options are exposed in the plan
2 participants