https://cloudposse.com logo
Join Slack
Powered by
when using the new secrets how can I use terraform...
# atmos
d
when using the new secrets how can I use terraform plan? I have imported my s3 access and secret key via secrets but they are passed as MASKED to plan
e
They should not be getting passed as masked to the plan; the output of the plan is masked.
Are you saying you're seeing literal 
MASKED
values?
Atmos has an IO layer which masks any output registered as a secret value
But that is just on the output, not what gets passed to terraform.
d
I am havign to pass --mask=false into my plan operations
when I am passing outputs across my components
e
Thanks—that detail about passing outputs between components was the key. We found a bug.
Secrets resolved directly by the component being executed worked correctly (e.g. 
!secret
), with masking applied only to displayed output. But cross-component lookups could reuse our inspection code, which substitutes literal 
<MASKED>
values without fetching the secrets.
That could affect the referenced component’s backend credentials or values, explaining why 
--mask=false
helped.
PR #3174, shipping in Atmos 1.229.0, fixes this path so execution receives real secrets while displayed output remains masked.
We’ve added regression tests that reproduce the failure and pass with the fix. You shouldn’t need to disable masking for this. Sorry for the disruption.
Once the CI completes, you can help validate the fix by running atmos with 
--use-version=3174
3 Views
Open in Slack
PreviousNext
Powered by