Secrets from the AD, AWS, Azure & Nomad Secrets Engines are sensitive

vault/data_source_ad_credentials.go

@@ -28,11 +28,13 @@ func adAccessCredentialsDataSource() *schema.Resource {
 				Type:        schema.TypeString,
 				Computed:    true,
 				Description: "Password for the service account.",
+				Sensitive:   true,
 			},
 			"last_password": {
 				Type:        schema.TypeString,
 				Computed:    true,
 				Description: "Last known password for the service account.",
+				Sensitive:   true,
 			},
 			"username": {
 				Type:        schema.TypeString,

vault/data_source_aws_access_credentials.go

@@ -94,6 +94,7 @@ func awsAccessCredentialsDataSource() *schema.Resource {
 				Type:        schema.TypeString,
 				Computed:    true,
 				Description: "AWS security token read from Vault. (Only returned if type is 'sts').",
+				Sensitive:   true,
 			},
 
 			consts.FieldLeaseID: {

vault/data_source_azure_access_credentials.go

@@ -67,6 +67,7 @@ func azureAccessCredentialsDataSource() *schema.Resource {
 				Type:        schema.TypeString,
 				Computed:    true,
 				Description: "The client secret for credentials to query the Azure APIs.",
+				Sensitive:   true,
 			},
 			consts.FieldLeaseID: {
 				Type:        schema.TypeString,

vault/data_source_nomad_credentials.go

@@ -33,6 +33,7 @@ func nomadAccessCredentialsDataSource() *schema.Resource {
 				Type:        schema.TypeString,
 				Computed:    true,
 				Description: "Used to make requests to Nomad and should be kept private.",
+				Sensitive:   true,
 			},
 		},
 	}