Skip to content

Commit b8048ea

Browse files
blgmblgm
authored
chore: annotate sensitive terraform varaibles (#712)
By annotating terraform variables that contain sensitive information, we ensure that they are not printed out in error messages. This re-implements #356 which previously had to be reverted due to not being supported by the version of terraform at the time. Note that we have not chosen to annotate IDs (e.g. user IDs) as sensitive, but only secrets/passwords. This is because printing out an ID in an error message can be very helpful. [#183474479](https://www.pivotaltracker.com/story/show/183474479)
1 parent 1a2c38c commit b8048ea

File tree

23 files changed

+104
-37
lines changed

23 files changed

+104
-37
lines changed

‎azure-mssql-fog-run-failover.yml

+1
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ provision:
6363
default: false
6464
template_refs:
6565
versions: terraform/azure-mssql-db-failover/run-failover/run-failover-versions.tf
66+
variables: terraform/azure-mssql-db-failover/run-failover/variables.tf
6667
providers: terraform/azure-mssql-db-failover/run-failover/run-failover-providers.tf
6768
main: terraform/azure-mssql-db-failover/run-failover/run-failover.tf
6869
computed_inputs: []

‎terraform/azure-cosmosdb/provision/variables.tf

+4-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
variable "azure_tenant_id" { type = string }
22
variable "azure_subscription_id" { type = string }
33
variable "azure_client_id" { type = string }
4-
variable "azure_client_secret" { type = string }
4+
variable "azure_client_secret" {
5+
type = string
6+
sensitive = true
7+
}
58
variable "skip_provider_registration" { type = bool }
69
variable "instance_name" { type = string }
710
variable "resource_group" { type = string }

‎terraform/azure-eventhubs/bind/variables.tf

+4-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
variable "azure_tenant_id" { type = string }
22
variable "azure_subscription_id" { type = string }
33
variable "azure_client_id" { type = string }
4-
variable "azure_client_secret" { type = string }
4+
variable "azure_client_secret" {
5+
type = string
6+
sensitive = true
7+
}
58
variable "skip_provider_registration" { type = bool }
69
variable "eventhub_rg_name" { type = string }
710
variable "namespace_name" { type = string }

‎terraform/azure-eventhubs/provision/variables.tf

+4-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
variable "azure_tenant_id" { type = string }
22
variable "azure_subscription_id" { type = string }
33
variable "azure_client_id" { type = string }
4-
variable "azure_client_secret" { type = string }
4+
variable "azure_client_secret" {
5+
type = string
6+
sensitive = true
7+
}
58
variable "skip_provider_registration" { type = bool }
69
variable "instance_name" { type = string }
710
variable "resource_group" { type = string }

‎terraform/azure-mongodb/provision/variables.tf

+4-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,10 @@ variable "instance_name" { type = string }
33
variable "azure_tenant_id" { type = string }
44
variable "azure_subscription_id" { type = string }
55
variable "azure_client_id" { type = string }
6-
variable "azure_client_secret" { type = string }
6+
variable "azure_client_secret" {
7+
type = string
8+
sensitive = true
9+
}
710
variable "account_name" { type = string }
811
variable "db_name" { type = string }
912
variable "collection_name" { type = string }

‎terraform/azure-mssql-db-failover/azure-provider.tf

-6
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,6 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
variable "azure_subscription_id" { type = string }
16-
variable "azure_client_id" { type = string }
17-
variable "azure_client_secret" { type = string }
18-
variable "azure_tenant_id" { type = string }
19-
variable "skip_provider_registration" { type = bool }
20-
2115
provider "azurerm" {
2216
features {}
2317

‎terraform/azure-mssql-db-failover/mssql-db-fog-variables.tf

+12-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,16 @@
1+
variable "azure_subscription_id" { type = string }
2+
variable "azure_client_id" { type = string }
3+
variable "azure_client_secret" {
4+
type = string
5+
sensitive = true
6+
}
7+
variable "azure_tenant_id" { type = string }
8+
variable "skip_provider_registration" { type = bool }
19
variable "instance_name" { type = string }
2-
variable "server_credential_pairs" { type = map(any) }
10+
variable "server_credential_pairs" {
11+
type = map(any)
12+
sensitive = true
13+
}
314
variable "server_pair" { type = string }
415
variable "db_name" { type = string }
516
variable "labels" { type = map(any) }

‎terraform/azure-mssql-db-failover/run-failover/run-failover-providers.tf

-5
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,3 @@
1-
variable "azure_tenant_id" { type = string }
2-
variable "azure_subscription_id" { type = string }
3-
variable "azure_client_id" { type = string }
4-
variable "azure_client_secret" { type = string }
5-
61
provider "csbmssqldbrunfailover" {
72
azure_tenant_id = var.azure_tenant_id
83
azure_client_id = var.azure_client_id

‎terraform/azure-mssql-db-failover/run-failover/variables.tf

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
variable "azure_tenant_id" { type = string }
2+
variable "azure_subscription_id" { type = string }
3+
variable "azure_client_id" { type = string }
4+
variable "azure_client_secret" {
5+
type = string
6+
sensitive = true
7+
}

‎terraform/azure-mssql-db/bind/mssql-bind-variables.tf

+8-2
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,12 @@ variable "mssql_db_name" { type = string }
1616
variable "mssql_hostname" { type = string }
1717
variable "mssql_port" { type = number }
1818
variable "admin_username" { type = string }
19-
variable "admin_password" { type = string }
19+
variable "admin_password" {
20+
type = string
21+
sensitive = true
22+
}
2023
variable "server" { type = string }
21-
variable "server_credentials" { type = map(any) }
24+
variable "server_credentials" {
25+
type = map(any)
26+
sensitive = true
27+
}

‎terraform/azure-mssql-db/provision/mssql-db-providers.tf

-6
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,6 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
variable "azure_subscription_id" { type = string }
16-
variable "azure_client_id" { type = string }
17-
variable "azure_client_secret" { type = string }
18-
variable "azure_tenant_id" { type = string }
19-
variable "skip_provider_registration" { type = bool }
20-
2115
provider "azurerm" {
2216
features {}
2317

‎terraform/azure-mssql-db/provision/mssql-db-variables.tf

+12-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,17 @@
1+
variable "azure_subscription_id" { type = string }
2+
variable "azure_client_id" { type = string }
3+
variable "azure_client_secret" {
4+
type = string
5+
sensitive = true
6+
}
7+
variable "azure_tenant_id" { type = string }
8+
variable "skip_provider_registration" { type = bool }
19
variable "db_name" { type = string }
210
variable "server" { type = string }
3-
variable "server_credentials" { type = map(any) }
11+
variable "server_credentials" {
12+
type = map(any)
13+
sensitive = true
14+
}
415
variable "labels" { type = map(any) }
516
variable "sku_name" { type = string }
617
variable "cores" { type = number }

‎terraform/azure-mssql-failover/provision/variables.tf

+4-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,10 @@ variable "instance_name" { type = string }
22
variable "azure_tenant_id" { type = string }
33
variable "azure_subscription_id" { type = string }
44
variable "azure_client_id" { type = string }
5-
variable "azure_client_secret" { type = string }
5+
variable "azure_client_secret" {
6+
type = string
7+
sensitive = true
8+
}
69
variable "resource_group" { type = string }
710
variable "db_name" { type = string }
811
variable "location" { type = string }

‎terraform/azure-mssql-server/provision/variables.tf

+8-2
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,16 @@ variable "instance_name" { type = string }
22
variable "azure_tenant_id" { type = string }
33
variable "azure_subscription_id" { type = string }
44
variable "azure_client_id" { type = string }
5-
variable "azure_client_secret" { type = string }
5+
variable "azure_client_secret" {
6+
type = string
7+
sensitive = true
8+
}
69
variable "resource_group" { type = string }
710
variable "admin_username" { type = string }
8-
variable "admin_password" { type = string }
11+
variable "admin_password" {
12+
type = string
13+
sensitive = true
14+
}
915
variable "location" { type = string }
1016
variable "labels" { type = map(any) }
1117
variable "authorized_network" { type = string }

‎terraform/azure-mssql/bind/variables.tf

+4-1
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,7 @@ variable "mssql_db_name" { type = string }
22
variable "mssql_hostname" { type = string }
33
variable "mssql_port" { type = number }
44
variable "admin_username" { type = string }
5-
variable "admin_password" { type = string }
5+
variable "admin_password" {
6+
type = string
7+
sensitive = true
8+
}

‎terraform/azure-mssql/provision/variables.tf

+4-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,10 @@ variable "location" { type = string }
55
variable "azure_tenant_id" { type = string }
66
variable "azure_subscription_id" { type = string }
77
variable "azure_client_id" { type = string }
8-
variable "azure_client_secret" { type = string }
8+
variable "azure_client_secret" {
9+
type = string
10+
sensitive = true
11+
}
912
variable "labels" { type = map(any) }
1013
variable "sku_name" { type = string }
1114
variable "cores" { type = number }

‎terraform/azure-mysql/bind/variables.tf

+4-1
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,8 @@ variable "mysql_db_name" { type = string }
22
variable "mysql_hostname" { type = string }
33
variable "mysql_port" { type = number }
44
variable "admin_username" { type = string }
5-
variable "admin_password" { type = string }
5+
variable "admin_password" {
6+
type = string
7+
sensitive = true
8+
}
69
variable "use_tls" { type = bool }

‎terraform/azure-mysql/provision/variables.tf

+4-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,10 @@ variable "resource_group" { type = string }
33
variable "azure_tenant_id" { type = string }
44
variable "azure_subscription_id" { type = string }
55
variable "azure_client_id" { type = string }
6-
variable "azure_client_secret" { type = string }
6+
variable "azure_client_secret" {
7+
type = string
8+
sensitive = true
9+
}
710
variable "db_name" { type = string }
811
variable "mysql_version" { type = string }
912
variable "location" { type = string }

‎terraform/azure-postgres/bind/variables.tf

+4-1
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,8 @@ variable "db_name" { type = string }
22
variable "hostname" { type = string }
33
variable "port" { type = number }
44
variable "admin_username" { type = string }
5-
variable "admin_password" { type = string }
5+
variable "admin_password" {
6+
type = string
7+
sensitive = true
8+
}
69
variable "use_tls" { type = bool }

‎terraform/azure-postgres/provision/variables.tf

+4-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,10 @@ variable "resource_group" { type = string }
88
variable "azure_tenant_id" { type = string }
99
variable "azure_subscription_id" { type = string }
1010
variable "azure_client_id" { type = string }
11-
variable "azure_client_secret" { type = string }
11+
variable "azure_client_secret" {
12+
type = string
13+
sensitive = true
14+
}
1215
variable "postgres_version" { type = string }
1316
variable "sku_name" { type = string }
1417
variable "authorized_network" { type = string }

‎terraform/azure-redis/provision/variables.tf

+4-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,10 @@ variable "resource_group" { type = string }
22
variable "azure_tenant_id" { type = string }
33
variable "azure_subscription_id" { type = string }
44
variable "azure_client_id" { type = string }
5-
variable "azure_client_secret" { type = string }
5+
variable "azure_client_secret" {
6+
type = string
7+
sensitive = true
8+
}
69
variable "sku_name" { type = string }
710
variable "redis_version" { type = string }
811
variable "family" { type = string }

‎terraform/azure-resource-group/provision/variables.tf

+4-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,10 @@ variable "instance_name" { type = string }
22
variable "azure_tenant_id" { type = string }
33
variable "azure_subscription_id" { type = string }
44
variable "azure_client_id" { type = string }
5-
variable "azure_client_secret" { type = string }
5+
variable "azure_client_secret" {
6+
type = string
7+
sensitive = true
8+
}
69
variable "location" { type = string }
710
variable "labels" { type = map(any) }
811
variable "skip_provider_registration" { type = bool }

‎terraform/azure-storage/provision/variables.tf

+4-1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ variable "resource_group" { type = string }
77
variable "azure_tenant_id" { type = string }
88
variable "azure_subscription_id" { type = string }
99
variable "azure_client_id" { type = string }
10-
variable "azure_client_secret" { type = string }
10+
variable "azure_client_secret" {
11+
type = string
12+
sensitive = true
13+
}
1114
variable "skip_provider_registration" { type = bool }
1215
variable "authorized_networks" { type = list(string) }

0 commit comments

Comments
 (0)