chef_attribute_merge.md

conf = {}.merge(node['cookbook']['conf']) # a workaround for Chef dsl not supporting clone or deep copy

ruby_block 'keep sensitive values separate from conf attributes' do
  block do
    data_bag_app = node['cookbook']['data_bag']
    mysql_bag = Chef::EncryptedDataBagItem.load(data_bag_app, 'mysql')
    aws_bag = Chef::EncryptedDataBagItem.load(data_bag_app, 'aws')

    conf.merge!(
      db_pass: mysql_bag[node['cookbook']['conf']['db_user']],
      aws_access_key: aws_bag['aws_access_key'],
      aws_secret_key: aws_bag['aws_secret_key'],
      mail_smtp_user: aws_bag['mail_smtp_user'],
      mail_smtp_pass: aws_bag['mail_smtp_pass']
    )
  end
end