Stack status output is leaking secrets.

[liamawhite]

Hello!

• Vote on this issue by adding a 👍 reaction
• To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already)

Issue details

If I run pulumi stack output the secrets are redacted. However, they are still in clear text in the stack output status.

Steps to reproduce

My stack config is:

apiVersion: pulumi.com/v1alpha1
kind: Stack
...
spec:
  backend: s3://cloud-pulumi-state
  branch: refs/heads/master
...
  projectRepo: [email protected]:tetrateio/tetrate.git
  repoDir: cloud/projects/operations/storage/aws
  secretsProvider: <REDACTED>
  stack: operations.storage.aws
  useLocalStackOnly: true

[viveklak]

I added a test in #206 to replicate the issue but it seems to behave correctly. Wonder what I am not capturing about your scenario there?

[viveklak]

The specific issue seems to stem from the stack exporting a nested object with mixed secret/non-secret items, e.g.:

elasticsearch:
      endpoint: not-secret
      kibana:
        clusterId: not-secret
        endpoint: not-secret
        port: not-secret
      password: SECRET
      port: not-secret
      username: SECRET

Currently the CLI seems to mark the individual items as secrets while automation api only examines the top level object's secret annotation thus elasticsearch is seen to have no secret values, resulting in the nested secrets being leaked.

[viveklak]

One workaround is to not emit secrets in a nested manner and essentially mark the object as a secret: pulumi.secret(elasticsearch)