hashicorp / hashicorp/terraform-provider-vault

`vault_generic_endpoint` resource does not display the `data_json` parameter in plans

Open
#1,663 3 comments 6 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
509
Forks
615
Avg merge
7d 2h
Merged PRs (30d)
15

Description

The `vault_generic_endpoint` resource does not display the `data_json` parameter in plans. This makes it hard to understand what changes will be applied and introduces additional risks. The results of an apply could be different than expected.

### Terraform Version

```bash
$ terraform version
Terraform v1.3.2
...
```

### Affected Resource(s)

- vault_generic_endpoint

### Terraform Configuration Files

In my example I am creating a new PKI role and I am using `vault_generic_endpoint` because `allow_wildcard_certificates` is not supported by the `vault_pki_secret_backend_role` resource. I would like to be able to see the expected change on apply but `data_json` is forced `sensitive` and does not display in plans.

```hcl
resource "vault_generic_endpoint" "new-pki-role" {
path = "pki/roles/new-pki-role"
data_json = jsonencode({
ttl = 3600
max_ttl = 3600
key_type = "rsa"
key_bits = 4096

allowed_domains = ["example.com"]
allow_subdomains = true

allow_wildcard_certificates = false # NOTE: Not supported by vault_pki_secret_backend_role
})
ignore_absent_fields = true
}
```

### Expected Behavior

If the value of `data_json` is nonsensitive it should be printed in the plan.

### Actual Behavior

```
+ resource "vault_generic_endpoint" "new-pki-role" {
+ data_json = (sensitive value)
+ disable_delete = false
+ disable_read = false
+ id = (known after apply)
+ ignore_absent_fields = true
+ path = "pki/roles/new-pki-role"
+ write_data = (known after apply)
+ write_data_json = (known after apply)
}
```

### Steps to Reproduce

Please list the steps required to reproduce the issue, for example:
1. `terraform plan`

### References

The marker that forces `data_json` to be sensitive:
https://github.com/hashicorp/terraform-provider-vault/blob/eae35c228b08cdd6636864535efcf2c5e2778d0e/vault/resource_generic_endpoint.go#L48

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.