41

The following code snippet is my terraform configuration to create an Azure SignalR Service:

output "signalrserviceconnstring" {
  value = azurerm_signalr_service.mysignalrservice.primary_connection_string
  description = "signalR service's primary connection string"
  sensitive = true
}

I got an error when sensitive = true is not included but I still do not see the output results on the console. What's the solution or workaround for this problem?

Arash
  • 3,628
  • 5
  • 46
  • 70

3 Answers3

66

The entire point of sensitive = true is to prevent the values from being displayed on the console every time you run terraform apply. You have to output the sensitive value explicitly, like this:

terraform output signalrserviceconnstring

I highly suggest reading the documentation.

Mark B
  • 183,023
  • 24
  • 297
  • 295
  • 1
    As far as I know this doesn't work for planned changes. Is there something similar to verify if changes to sensitive values are correct before they are applied? – Paul Apr 25 '22 at 14:42
43

You could use function nonsensitive like this

    output "mysecret" {
      value = nonsensitive(var.mysecret)
    }
OlegG
  • 927
  • 9
  • 11
  • 12
    This is also useful for the interactive `$ terraform console` command. Without formally declaring an output, `> nonsensitive(var.mysecret)` will print the secret! – N1ngu Apr 22 '22 at 12:17
  • This is also useful when testing with `terraform plan` command to test if the output string is what you expect to be. After tests you just remove the output so nothing will be saved. – JB68 Jul 28 '22 at 16:53
  • This is the only thing I could make work. Even setting `sensitive = false` terraform refused to print it. Really hard to debug when you can't see anything, and it's even more maddening because I didn't mark it sensitive in the first place! Terraform just decided it was sensitive because (I assume) of some of the names inside the contents. – Freedom_Ben May 16 '23 at 21:15
1

If you want to get a sensitive value from the state rather than from the output, use this:

$ terraform show -json | \
  jq '.values.root_module.resources[] | select(.address == "tls_private_key.ssh_key")' 
{
  "address": "tls_private_key.server_ssh_key",
  "type": "tls_private_key",
  "name": "server_ssh_key",
  ...
  "values": {
    "algorithm": "ED25519",
    "private_key_openssh": "-----BEGIN OPENSSH PRIVATE KEY-----\n...",
    ...
  }
}
kolypto
  • 31,774
  • 17
  • 105
  • 99