azurerm provider should define kube_config_raw as sensitive

[ghost]

This issue was originally opened by @subesokun as hashicorp/terraform#18013. It was migrated here as a result of the provider split. The original body of the issue is below.

---

Terraform Version

Terraform v0.11.7
provider.azurerm: version = "~> 1.4"

Debug Output

https://gist.github.com/subesokun/ae9893a093c4ce7fcdebf2cb5cc95c0d

Expected Behavior

If a kubernetes cluster gets re-deployed the kube_config_raw content shouldn't be visible in the console log and be marked as <sensitive>

Actual Behavior

kube_config_raw content gets printed in clear text into the console log.

Steps to Reproduce

1. terraform init
2. terraform apply
3. Change some attribute like the linux_profile.ssh_key
4. terraform apply

Additional Context

We're deploying our kubernetes clusters as part of our CI/CD pipelines and usually every developer in the project has access to the deployment logs of those pipelines and hence we need to keep the console logs clean from any sensitive data. Now as the kube_config_raw gets logged in clear text into the console this is very critical to us as everybody with access to the logs could access the cluster and compromise it which we have to prevent by all means.

[subesokun]

Awesome, thanks a lot!

[katbyte]

Hey @subesokun

Just a heads up that we have released v1.5.0 of the provider that includes this fix 🙂

[subesokun]

@katbyte thanks for the heads up! Unfortunately I've noticed today that also in the azurerm_storage_account the primary access key, secondary access key and the connection strings are getting printed in clear text in the execution plan if the storage account needs to be recreated. So if you don't execute that plan immediately you'll face a security risk. But I guess I should open another issue for it :)

[subesokun]

#1239

[katbyte]

Yep! Thanks for letting us know 🙂

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!