Skip to content

Commit 750dc9b

Browse files
sourcehawksourcehawk
committed
nonsensitive -> sensitive
1 parent 2723ed1 commit 750dc9b

File tree

14 files changed

+34
-34
lines changed

14 files changed

+34
-34
lines changed

‎examples/docker-init/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ resource "null_resource" "postgres_docker" {
7171
"PG_DATABASE" = local.maintenance_database
7272
"PG_PORT" = local.database_port
7373
# If you declare it here, it will be stored in the state file, you can move it inside the template to prevent that.
74-
"PG_PASSWORD" = nonsensitive(jsondecode(data.aws_secretsmanager_secret_version.user_credentials.secret_string)["password"])
74+
"PG_PASSWORD" = sensitive(jsondecode(data.aws_secretsmanager_secret_version.user_credentials.secret_string)["password"])
7575
}
7676
quiet = true
7777
command = <<EOT

‎modules/credentials/database/_variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,5 +78,5 @@ variable "engine" {
7878

7979
locals {
8080
id = var.id == null ? "master" : var.id
81-
database_password = nonsensitive(jsondecode(data.aws_secretsmanager_secret_version.user.secret_string)["password"])
81+
database_password = sensitive(jsondecode(data.aws_secretsmanager_secret_version.user.secret_string)["password"])
8282
}

‎modules/credentials/user/_variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,5 +83,5 @@ variable "regenerate_password" {
8383

8484
locals {
8585
id = var.id == null ? "master" : var.id
86-
password_supplied = nonsensitive(var.password == null ? "false" : "true")
86+
password_supplied = sensitive(var.password == null ? "false" : "true")
8787
}

‎modules/credentials/user/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ resource "null_resource" "user_credentials" {
2121
if [ "${local.password_supplied}" = "false" ]; then
2222
PASSWORD=$(openssl rand -base64 256 | tr -dc 'A-Za-z0-9_!@#' | head -c 16)
2323
else
24-
PASSWORD='${nonsensitive(var.password == null ? "" : var.password)}'
24+
PASSWORD='${sensitive(var.password == null ? "" : var.password)}'
2525
fi
2626
2727
if [ "$SECRET_EXISTS" = "not-found" ]; then

‎modules/postgres_init/modules/database/_data.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
data "aws_secretsmanager_secret" "superuser" {
2-
count = nonsensitive(var.conn.password) == null ? 1 : 0
2+
count = sensitive(var.conn.password) == null ? 1 : 0
33
name = "${var.conn.environment}/database-server/${var.conn.server_name}/user/master"
44
}
55

66
data "aws_secretsmanager_secret_version" "superuser" {
7-
count = nonsensitive(var.conn.password) == null ? 1 : 0
7+
count = sensitive(var.conn.password) == null ? 1 : 0
88
secret_id = data.aws_secretsmanager_secret.superuser[0].id
99
version_stage = "AWSCURRENT"
1010
}

‎modules/postgres_init/modules/database/_variables.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -69,8 +69,8 @@ locals {
6969
owner_name = jsondecode(data.aws_secretsmanager_secret_version.owner.secret_string)["username"]
7070
extensions_map = { for ext in var.extensions : "${ext.name}@${ext.schema}" => ext }
7171
schemas_map = { for schema in var.schemas : schema => schema }
72-
pg_password = (nonsensitive(var.conn.password) == null
73-
? nonsensitive(jsondecode(data.aws_secretsmanager_secret_version.superuser[0].secret_string)["password"])
74-
: nonsensitive(var.conn.password)
72+
pg_password = (sensitive(var.conn.password) == null
73+
? sensitive(jsondecode(data.aws_secretsmanager_secret_version.superuser[0].secret_string)["password"])
74+
: sensitive(var.conn.password)
7575
)
7676
}

‎modules/postgres_init/modules/database/main.tf

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ resource "null_resource" "create_database" {
3030
}
3131
command = <<EOT
3232
set -e
33-
export PGPASSWORD='${nonsensitive(local.pg_password)}'
33+
export PGPASSWORD='${sensitive(local.pg_password)}'
3434
export DATABASE_NAME="${var.name}"
3535
export DATABASE_OWNER="${local.owner_name}"
3636
chmod +x ${path.module}/sql/create_database.sh
@@ -55,7 +55,7 @@ resource "null_resource" "rename_database" {
5555
}
5656
command = <<EOT
5757
set -e
58-
export PGPASSWORD='${nonsensitive(local.pg_password)}'
58+
export PGPASSWORD='${sensitive(local.pg_password)}'
5959
if [ "${var.old_name == null ? "" : var.old_name}" = "" ]; then
6060
echo "Detected change in database name but old_name was not provided. Skipping database renaming."
6161
exit 0
@@ -92,7 +92,7 @@ resource "null_resource" "create_schema" {
9292
}
9393
command = <<EOT
9494
set -e
95-
export PGPASSWORD='${nonsensitive(local.pg_password)}'
95+
export PGPASSWORD='${sensitive(local.pg_password)}'
9696
psql \
9797
-v ON_ERROR_STOP=1 \
9898
-v schema_name="${each.value}" \
@@ -121,7 +121,7 @@ resource "null_resource" "create_extension" {
121121
}
122122
command = <<EOT
123123
set -e
124-
export PGPASSWORD='${nonsensitive(local.pg_password)}'
124+
export PGPASSWORD='${sensitive(local.pg_password)}'
125125
psql \
126126
-v ON_ERROR_STOP=1 \
127127
-v schema_name="${each.value.schema}" \

‎modules/postgres_init/modules/script/_variables.tf

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -83,16 +83,16 @@ variable "rerun_on_user_change" {
8383
}
8484

8585
locals {
86-
must_retrieve_user = !(var.user_id == "master" && nonsensitive(var.conn.password) != null)
87-
must_retrieve_database = !(var.database_id == "master" && nonsensitive(var.conn.password) != null)
86+
must_retrieve_user = !(var.user_id == "master" && sensitive(var.conn.password) != null)
87+
must_retrieve_database = !(var.database_id == "master" && sensitive(var.conn.password) != null)
8888
}
8989

9090
locals {
9191
secrets = {
9292
for k, v in var.secrets : k => (
9393
lookup(v, "key", null) == null
94-
? nonsensitive(data.aws_secretsmanager_secret_version.secrets[k].secret_string)
95-
: nonsensitive(jsondecode(data.aws_secretsmanager_secret_version.secrets[k].secret_string)[v.key])
94+
? sensitive(data.aws_secretsmanager_secret_version.secrets[k].secret_string)
95+
: sensitive(jsondecode(data.aws_secretsmanager_secret_version.secrets[k].secret_string)[v.key])
9696
)
9797
}
9898
pg_user = (
@@ -102,8 +102,8 @@ locals {
102102
)
103103
pg_password = (
104104
local.must_retrieve_user
105-
? nonsensitive(jsondecode(data.aws_secretsmanager_secret_version.user[0].secret_string)["password"])
106-
: nonsensitive(var.conn.password)
105+
? sensitive(jsondecode(data.aws_secretsmanager_secret_version.user[0].secret_string)["password"])
106+
: sensitive(var.conn.password)
107107
)
108108
pg_database = (
109109
local.must_retrieve_database
@@ -114,8 +114,8 @@ locals {
114114

115115
locals {
116116
user_change = (
117-
nonsensitive(var.conn.password) == null
117+
sensitive(var.conn.password) == null
118118
? data.aws_secretsmanager_secret_version.user[0].version_id
119-
: sha256("${local.pg_user}-${sha256(nonsensitive(var.conn.password))}")
119+
: sha256("${local.pg_user}-${sha256(sensitive(var.conn.password))}")
120120
)
121121
}

‎modules/postgres_init/modules/script/main.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ resource "null_resource" "shell_script" {
1919
})
2020
command = <<EOT
2121
set -e
22-
export PGPASSWORD='${nonsensitive(local.pg_password)}'
22+
export PGPASSWORD='${sensitive(local.pg_password)}'
2323
chmod +x ${var.script}
2424
${var.script}
2525
EOT
@@ -46,7 +46,7 @@ resource "null_resource" "sql_script" {
4646
}
4747
command = <<EOT
4848
set -e
49-
export PGPASSWORD='${nonsensitive(local.pg_password)}'
49+
export PGPASSWORD='${sensitive(local.pg_password)}'
5050
psql \
5151
-v ON_ERROR_STOP=1 \
5252
%{~for v in keys(var.variables)~}

‎modules/postgres_init/modules/user/_data.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
data "aws_secretsmanager_secret" "superuser" {
2-
count = nonsensitive(var.conn.password) == null ? 1 : 0
2+
count = sensitive(var.conn.password) == null ? 1 : 0
33
name = "${var.conn.environment}/database-server/${var.conn.server_name}/user/master"
44
}
55

66
data "aws_secretsmanager_secret_version" "superuser" {
7-
count = nonsensitive(var.conn.password) == null ? 1 : 0
7+
count = sensitive(var.conn.password) == null ? 1 : 0
88
secret_id = data.aws_secretsmanager_secret.superuser[0].id
99
version_stage = "AWSCURRENT"
1010
}

‎modules/postgres_init/modules/user/_variables.tf

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -64,12 +64,12 @@ variable "regenerate_password" {
6464
}
6565

6666
locals {
67-
pg_password = (nonsensitive(var.conn.password) == null
68-
? nonsensitive(jsondecode(data.aws_secretsmanager_secret_version.superuser[0].secret_string)["password"])
69-
: nonsensitive(var.conn.password)
67+
pg_password = (sensitive(var.conn.password) == null
68+
? sensitive(jsondecode(data.aws_secretsmanager_secret_version.superuser[0].secret_string)["password"])
69+
: sensitive(var.conn.password)
7070
)
7171
user_password = (var.password == null
72-
? nonsensitive(jsondecode(data.aws_secretsmanager_secret_version.user.secret_string)["password"])
72+
? sensitive(jsondecode(data.aws_secretsmanager_secret_version.user.secret_string)["password"])
7373
: var.password
7474
)
7575
}

‎modules/postgres_init/modules/user/main.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ resource "null_resource" "update_username" {
3232
echo "Detected change in username but old_name was not provided. Skipping user renaming."
3333
exit 0
3434
fi
35-
export PGPASSWORD='${nonsensitive(local.pg_password)}'
35+
export PGPASSWORD='${sensitive(local.pg_password)}'
3636
export NEW_USERNAME=${var.name}
3737
export OLD_USERNAME=${var.old_name == null ? "" : var.old_name}
3838
if [ "$NEW_USERNAME" = "$OLD_USERNAME" ]; then
@@ -64,9 +64,9 @@ resource "null_resource" "create_user_or_update_password" {
6464
}
6565
command = <<EOT
6666
set -e
67-
export PGPASSWORD='${nonsensitive(local.pg_password)}'
67+
export PGPASSWORD='${sensitive(local.pg_password)}'
6868
export USERNAME=${var.name}
69-
export PASSWORD='${nonsensitive(jsondecode(data.aws_secretsmanager_secret_version.user.secret_string)["password"])}'
69+
export PASSWORD='${sensitive(jsondecode(data.aws_secretsmanager_secret_version.user.secret_string)["password"])}'
7070
chmod +x ${path.module}/sql/create_user.sh
7171
${path.module}/sql/create_user.sh
7272
EOT

‎modules/postgres_rds/_variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,7 @@ locals {
189189
]
190190
master_password = (
191191
var.existing_user_credentials == null
192-
? nonsensitive(jsondecode(data.aws_secretsmanager_secret_version.master.secret_string)["password"])
192+
? sensitive(jsondecode(data.aws_secretsmanager_secret_version.master.secret_string)["password"])
193193
: var.existing_user_credentials.password
194194
)
195195
}

‎modules/postgres_rds/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -289,7 +289,7 @@ resource "null_resource" "update_master_password" {
289289
290290
wait_for_available ${aws_db_instance.this.identifier}
291291
292-
export PGPASSWORD='${nonsensitive(local.master_password)}'
292+
export PGPASSWORD='${sensitive(local.master_password)}'
293293
294294
# Wait for the password change to take effect
295295
attempts=0

0 commit comments

Comments
 (0)