terraform config_error ai_generated true

Error: Output refers to sensitive values: output value depends on sensitive attributes

ID: terraform/tf-sensitive-value-output

Also available as: JSON · Markdown
92%Fix Rate
93%Confidence
70Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
1 active — — —

Root Cause

An output value references a sensitive attribute without being marked sensitive itself.

generic

Workarounds

  1. 95% success Mark the output as sensitive = true 
    Add sensitive = true to the output block: output "name" { value = EXPR; sensitive = true }

    Sources: https://developer.hashicorp.com/terraform/language/values/outputs

  2. 80% success Use nonsensitive() only when the value is not actually sensitive (e.g., resource ID derived from sensitive input) 
    output "id" { value = nonsensitive(resource.example.id) } when the ID itself is not a secret

    Sources: https://developer.hashicorp.com/terraform/language/functions/nonsensitive

Dead Ends

Common approaches that don't work:

  1. Use nonsensitive() on actually sensitive values to bypass the check 80% fail

    nonsensitive() removes protection from genuinely sensitive data like passwords and keys, exposing them in plan output

  2. Remove the sensitive flag from the source variable or resource attribute 85% fail

    The upstream provider marks attributes as sensitive for security reasons; this cannot be changed

Error Chain

Leads to:
Preceded by:
Frequently confused with: