I believe this applies to other resource/block types, but once you add a sensitive value to any aws_cloudfront_distribution
's origin
blocks. Changes to any aws_cloudfront_distribution
's origin
block will be masked in terraform plan
output.
This hides important diff information from me.
Steps to reproduce:
- Spin up a CloudFront distribution using these tf files, in their stock state.
- Make a change to the
origin_b_nonsensitive
origin; e.g., change itsorigin_read_timeout
to 59 terraform plan
will show you the diff. Hooray! Happy day!- Use line 3 instead of line 2 to use a sensitive value (which gets used by
origin_a_sensitive
) terraform plan
again, but this time, the change you made to the non-sensitive block will not show diffs.
Not only is this behavior restricted to this aws_cloudfront_distribution
resource, you'll never see another diff for any origin in any CloudFront distribution in the same Terraform project. :-(