add note in docs to generated sensitive fields (#3393) (#1983)

* add note in docs to generated sensitive fields

* add note in docs to generated sensitive fields

* generate sensitive warning, new approach

* clean up some things

* changes from review

* add name&.underscore

Signed-off-by: Modular Magician <magic-modules@google.com>

.changelog/3393.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

google-beta/resource_compute_region_disk.go

@@ -110,6 +110,7 @@ you do not need to provide a key to use the disk later.`,
 							ForceNew: true,
 							Description: `Specifies a 256-bit customer-supplied encryption key, encoded in
 RFC 4648 base64 to either encrypt or decrypt this resource.`,
+							Sensitive: true,
 						},
 						"sha256": {
 							Type:     schema.TypeString,

website/docs/r/compute_backend_bucket_signed_url_key.html.markdown

@@ -31,10 +31,8 @@ To get more information about BackendBucketSignedUrlKey, see:
 * How-to Guides
     * [Using Signed URLs](https://cloud.google.com/cdn/docs/using-signed-urls/)
 
-~> **Warning:** All arguments including the key's value will be stored in the raw
+~> **Warning:** All arguments including `key_value` will be stored in the raw
 state as plain-text. [Read more about sensitive data in state](/docs/state/sensitive-data.html).
-Because the API does not return the sensitive key value,
-we cannot confirm or reverse changes to a key outside of Terraform.
 
 ## Example Usage - Backend Bucket Signed Url Key
 
@@ -71,7 +69,7 @@ The following arguments are supported:
 * `key_value` -
   (Required)
   128-bit key value used for signing the URL. The key value must be a
-  valid RFC 4648 Section 5 base64url encoded string.
+  valid RFC 4648 Section 5 base64url encoded string.  **Note**: This property is sensitive and will not be displayed in the plan.
 
 * `backend_bucket` -
   (Required)

website/docs/r/compute_backend_service.html.markdown

@@ -37,6 +37,9 @@ To get more information about BackendService, see:
 * How-to Guides
     * [Official Documentation](https://cloud.google.com/compute/docs/load-balancing/http/backend-service)
 
+~> **Warning:** All arguments including `iap.oauth2_client_secret` and `iap.oauth2_client_secret_sha256` will be stored in the raw
+state as plain-text. [Read more about sensitive data in state](/docs/state/sensitive-data.html).
+
 <div class = "oics-button" style="float: right; margin: 0 0 -15px">
   <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgit.luolix.top%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=backend_service_basic&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
     <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
@@ -540,10 +543,10 @@ The `iap` block supports:
 
 * `oauth2_client_secret` -
   (Required)
-  OAuth2 Client Secret for IAP
+  OAuth2 Client Secret for IAP  **Note**: This property is sensitive and will not be displayed in the plan.
 
 * `oauth2_client_secret_sha256` -
-  OAuth2 Client Secret SHA-256 for IAP
+  OAuth2 Client Secret SHA-256 for IAP  **Note**: This property is sensitive and will not be displayed in the plan.
 
 The `outlier_detection` block supports:
 

website/docs/r/compute_backend_service_signed_url_key.html.markdown

@@ -31,10 +31,8 @@ To get more information about BackendServiceSignedUrlKey, see:
 * How-to Guides
     * [Using Signed URLs](https://cloud.google.com/cdn/docs/using-signed-urls/)
 
-~> **Warning:** All arguments including the key's value will be stored in the raw
+~> **Warning:** All arguments including `key_value` will be stored in the raw
 state as plain-text. [Read more about sensitive data in state](/docs/state/sensitive-data.html).
-Because the API does not return the sensitive key value,
-we cannot confirm or reverse changes to a key outside of Terraform.
 
 ## Example Usage - Backend Service Signed Url Key
 
@@ -109,7 +107,7 @@ The following arguments are supported:
 * `key_value` -
   (Required)
   128-bit key value used for signing the URL. The key value must be a
-  valid RFC 4648 Section 5 base64url encoded string.
+  valid RFC 4648 Section 5 base64url encoded string.  **Note**: This property is sensitive and will not be displayed in the plan.
 
 * `backend_service` -
   (Required)

website/docs/r/compute_disk.html.markdown

@@ -46,9 +46,8 @@ To get more information about Disk, see:
 * How-to Guides
     * [Adding a persistent disk](https://cloud.google.com/compute/docs/disks/add-persistent-disk)
 
-~> **Warning:** All arguments including the disk encryption key will be stored in the raw
-state as plain-text.
-[Read more about sensitive data in state](/docs/state/sensitive-data.html).
+~> **Warning:** All arguments including `disk_encryption_key.raw_key` will be stored in the raw
+state as plain-text. [Read more about sensitive data in state](/docs/state/sensitive-data.html).
 
 <div class = "oics-button" style="float: right; margin: 0 0 -15px">
   <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgit.luolix.top%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=disk_basic&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
@@ -204,7 +203,7 @@ The `disk_encryption_key` block supports:
 * `raw_key` -
   (Optional)
   Specifies a 256-bit customer-supplied encryption key, encoded in
-  RFC 4648 base64 to either encrypt or decrypt this resource.
+  RFC 4648 base64 to either encrypt or decrypt this resource.  **Note**: This property is sensitive and will not be displayed in the plan.
 
 * `sha256` -
   The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied

website/docs/r/compute_region_disk.html.markdown

@@ -46,9 +46,8 @@ To get more information about RegionDisk, see:
 * How-to Guides
     * [Adding or Resizing Regional Persistent Disks](https://cloud.google.com/compute/docs/disks/regional-persistent-disk)
 
-~> **Warning:** All arguments including the disk encryption key will be stored in the raw
-state as plain-text.
-[Read more about sensitive data in state](/docs/state/sensitive-data.html).
+~> **Warning:** All arguments including `disk_encryption_key.raw_key` will be stored in the raw
+state as plain-text. [Read more about sensitive data in state](/docs/state/sensitive-data.html).
 
 <div class = "oics-button" style="float: right; margin: 0 0 -15px">
   <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgit.luolix.top%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=region_disk_basic&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
@@ -180,7 +179,7 @@ The `disk_encryption_key` block supports:
 * `raw_key` -
   (Optional)
   Specifies a 256-bit customer-supplied encryption key, encoded in
-  RFC 4648 base64 to either encrypt or decrypt this resource.
+  RFC 4648 base64 to either encrypt or decrypt this resource.  **Note**: This property is sensitive and will not be displayed in the plan.
 
 * `sha256` -
   The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied

website/docs/r/compute_region_ssl_certificate.html.markdown

@@ -33,6 +33,9 @@ To get more information about RegionSslCertificate, see:
 * How-to Guides
     * [Official Documentation](https://cloud.google.com/load-balancing/docs/ssl-certificates)
 
+~> **Warning:** All arguments including `certificate` and `private_key` will be stored in the raw
+state as plain-text. [Read more about sensitive data in state](/docs/state/sensitive-data.html).
+
 <div class = "oics-button" style="float: right; margin: 0 0 -15px">
   <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgit.luolix.top%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=region_ssl_certificate_basic&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
     <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
@@ -181,11 +184,11 @@ The following arguments are supported:
   (Required)
   The certificate in PEM format.
   The certificate chain must be no greater than 5 certs long.
-  The chain must include at least one intermediate cert.
+  The chain must include at least one intermediate cert.  **Note**: This property is sensitive and will not be displayed in the plan.
 
 * `private_key` -
   (Required)
-  The write-only private key in PEM format.
+  The write-only private key in PEM format.  **Note**: This property is sensitive and will not be displayed in the plan.
 
 
 - - -

website/docs/r/compute_snapshot.html.markdown

@@ -42,6 +42,9 @@ To get more information about Snapshot, see:
 * How-to Guides
     * [Official Documentation](https://cloud.google.com/compute/docs/disks/create-snapshots)
 
+~> **Warning:** All arguments including `snapshot_encryption_key.raw_key` and `source_disk_encryption_key.raw_key` will be stored in the raw
+state as plain-text. [Read more about sensitive data in state](/docs/state/sensitive-data.html).
+
 <div class = "oics-button" style="float: right; margin: 0 0 -15px">
   <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgit.luolix.top%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=snapshot_basic&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
     <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
@@ -129,7 +132,7 @@ The `snapshot_encryption_key` block supports:
 * `raw_key` -
   (Required)
   Specifies a 256-bit customer-supplied encryption key, encoded in
-  RFC 4648 base64 to either encrypt or decrypt this resource.
+  RFC 4648 base64 to either encrypt or decrypt this resource.  **Note**: This property is sensitive and will not be displayed in the plan.
 
 * `sha256` -
   The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied
@@ -140,7 +143,7 @@ The `source_disk_encryption_key` block supports:
 * `raw_key` -
   (Optional)
   Specifies a 256-bit customer-supplied encryption key, encoded in
-  RFC 4648 base64 to either encrypt or decrypt this resource.
+  RFC 4648 base64 to either encrypt or decrypt this resource.  **Note**: This property is sensitive and will not be displayed in the plan.
 
 ## Attributes Reference
 

website/docs/r/compute_ssl_certificate.html.markdown

@@ -33,6 +33,9 @@ To get more information about SslCertificate, see:
 * How-to Guides
     * [Official Documentation](https://cloud.google.com/load-balancing/docs/ssl-certificates)
 
+~> **Warning:** All arguments including `certificate` and `private_key` will be stored in the raw
+state as plain-text. [Read more about sensitive data in state](/docs/state/sensitive-data.html).
+
 <div class = "oics-button" style="float: right; margin: 0 0 -15px">
   <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgit.luolix.top%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=ssl_certificate_basic&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
     <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
@@ -169,11 +172,11 @@ The following arguments are supported:
   (Required)
   The certificate in PEM format.
   The certificate chain must be no greater than 5 certs long.
-  The chain must include at least one intermediate cert.
+  The chain must include at least one intermediate cert.  **Note**: This property is sensitive and will not be displayed in the plan.
 
 * `private_key` -
   (Required)
-  The write-only private key in PEM format.
+  The write-only private key in PEM format.  **Note**: This property is sensitive and will not be displayed in the plan.
 
 
 - - -

website/docs/r/compute_vpn_tunnel.html.markdown

@@ -32,9 +32,8 @@ To get more information about VpnTunnel, see:
     * [Cloud VPN Overview](https://cloud.google.com/vpn/docs/concepts/overview)
     * [Networks and Tunnel Routing](https://cloud.google.com/vpn/docs/concepts/choosing-networks-routing)
 
-~> **Warning:** All arguments including the shared secret will be stored in the raw
-state as plain-text.
-[Read more about sensitive data in state](/docs/state/sensitive-data.html).
+~> **Warning:** All arguments including `shared_secret` will be stored in the raw
+state as plain-text. [Read more about sensitive data in state](/docs/state/sensitive-data.html).
 
 <div class = "oics-button" style="float: right; margin: 0 0 -15px">
   <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgit.luolix.top%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=vpn_tunnel_basic&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
@@ -208,7 +207,7 @@ The following arguments are supported:
 * `shared_secret` -
   (Required)
   Shared secret used to set the secure session between the Cloud VPN
-  gateway and the peer VPN gateway.
+  gateway and the peer VPN gateway.  **Note**: This property is sensitive and will not be displayed in the plan.
 
 
 - - -

website/docs/r/iap_client.html.markdown

@@ -26,6 +26,9 @@ Contains the data that describes an Identity Aware Proxy owned client.
 
 
 
+~> **Warning:** All arguments including `secret` will be stored in the raw
+state as plain-text. [Read more about sensitive data in state](/docs/state/sensitive-data.html).
+
 <div class = "oics-button" style="float: right; margin: 0 0 -15px">
   <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgit.luolix.top%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=iap_client&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
     <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
@@ -85,7 +88,7 @@ In addition to the arguments listed above, the following computed attributes are
 * `id` - an identifier for the resource with format `{{brand}}/identityAwareProxyClients/{{client_id}}`
 
 * `secret` -
-  Output only. Client secret of the OAuth client.
+  Output only. Client secret of the OAuth client.  **Note**: This property is sensitive and will not be displayed in the plan.
 
 * `client_id` -
   Output only. Unique identifier of the OAuth client.

website/docs/r/kms_secret_ciphertext.html.markdown

@@ -37,6 +37,9 @@ To get more information about SecretCiphertext, see:
 * How-to Guides
     * [Encrypting and decrypting data with a symmetric key](https://cloud.google.com/kms/docs/encrypt-decrypt)
 
+~> **Warning:** All arguments including `plaintext` and `additional_authenticated_data` will be stored in the raw
+state as plain-text. [Read more about sensitive data in state](/docs/state/sensitive-data.html).
+
 ## Example Usage - Kms Secret Ciphertext Basic
 
 
@@ -92,7 +95,7 @@ The following arguments are supported:
 
 * `plaintext` -
   (Required)
-  The plaintext to be encrypted.
+  The plaintext to be encrypted.  **Note**: This property is sensitive and will not be displayed in the plan.
 
 * `crypto_key` -
   (Required)
@@ -105,7 +108,7 @@ The following arguments are supported:
 
 * `additional_authenticated_data` -
   (Optional)
-  The additional authenticated data used for integrity checks during encryption and decryption.
+  The additional authenticated data used for integrity checks during encryption and decryption.  **Note**: This property is sensitive and will not be displayed in the plan.
 
 
 ## Attributes Reference

website/docs/r/monitoring_notification_channel.html.markdown

@@ -48,6 +48,9 @@ To get more information about NotificationChannel, see:
     * [Notification Options](https://cloud.google.com/monitoring/support/notification-options)
     * [Monitoring API Documentation](https://cloud.google.com/monitoring/api/v3/)
 
+~> **Warning:** All arguments including `sensitive_labels.auth_token`, `sensitive_labels.password`, and `sensitive_labels.service_key` will be stored in the raw
+state as plain-text. [Read more about sensitive data in state](/docs/state/sensitive-data.html).
+
 <div class = "oics-button" style="float: right; margin: 0 0 -15px">
   <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgit.luolix.top%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=notification_channel_basic&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
     <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
@@ -136,15 +139,15 @@ The `sensitive_labels` block supports:
 
 * `auth_token` -
   (Optional)
-  An authorization token for a notification channel. Channel types that support this field include: slack
+  An authorization token for a notification channel. Channel types that support this field include: slack  **Note**: This property is sensitive and will not be displayed in the plan.
 
 * `password` -
   (Optional)
-  An password for a notification channel. Channel types that support this field include: webhook_basicauth
+  An password for a notification channel. Channel types that support this field include: webhook_basicauth  **Note**: This property is sensitive and will not be displayed in the plan.
 
 * `service_key` -
   (Optional)
-  An servicekey token for a notification channel. Channel types that support this field include: pagerduty
+  An servicekey token for a notification channel. Channel types that support this field include: pagerduty  **Note**: This property is sensitive and will not be displayed in the plan.
 
 ## Attributes Reference
 

website/docs/r/monitoring_uptime_check_config.html.markdown

@@ -31,6 +31,9 @@ To get more information about UptimeCheckConfig, see:
 * How-to Guides
     * [Official Documentation](https://cloud.google.com/monitoring/uptime-checks/)
 
+~> **Warning:** All arguments including `http_check.auth_info.password` will be stored in the raw
+state as plain-text. [Read more about sensitive data in state](/docs/state/sensitive-data.html).
+
 <div class = "oics-button" style="float: right; margin: 0 0 -15px">
   <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgit.luolix.top%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=uptime_check_config_http&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
     <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
@@ -214,7 +217,7 @@ The `auth_info` block supports:
 
 * `password` -
   (Required)
-  The password to authenticate.
+  The password to authenticate.  **Note**: This property is sensitive and will not be displayed in the plan.
 
 * `username` -
   (Required)

website/docs/r/secret_manager_secret_version.html.markdown

@@ -28,6 +28,9 @@ A secret version resource.
 See [Provider Versions](https://terraform.io/docs/providers/google/guides/provider_versions.html) for more details on beta resources.
 
 
+~> **Warning:** All arguments including `payload.secret_data` will be stored in the raw
+state as plain-text. [Read more about sensitive data in state](/docs/state/sensitive-data.html).
+
 <div class = "oics-button" style="float: right; margin: 0 0 -15px">
   <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgit.luolix.top%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=secret_version_basic&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
     <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
@@ -80,7 +83,7 @@ The following arguments are supported:
 
 * `secret_data` -
   (Optional)
-  The secret data. Must be no larger than 64KiB.
+  The secret data. Must be no larger than 64KiB.  **Note**: This property is sensitive and will not be displayed in the plan.
 
 
 ## Attributes Reference