aws_cloudformation_stack indefinitely reapplies changes in NoEcho parameters

[mtb-xt]

If a cloudformation template contains a parameter with NoEcho set to true (like a password), the parameter value is shown as asterisks "****".

Terraform 0.6.8 detects this as a parameter change and tries to reapply it on every 'plan' or 'apply':

aws_cloudformation_stack.redshift-prod: Modifying...
  parameters.MasterUserPassword: "****" => "lolmegapassword"

[radeksimko]

Thanks for this report too. 😃

A solution could be ignoring changes in NoEcho parameters coming from AWS, the only difficult part is in decoding the whole template as this attribute isn't available from the API directly.

[radeksimko]

This project may be helpful here:
https://github.com/awslabs/aws-cfn-go-template

[bobzoller]

Perhaps this is silly but it might also save someone from a headache: Don't be like me and try to work around this by adding:

lifecycle {
  ignore_changes = ["parameters.Password"]
}

All it means is that the next apply will write the **** value back to AWS (instead of your secret).

[dylanvaughn]

Maybe if the parameter name ends in NoEcho then that tells Terraform to ignore it? i.e. MasterDbPasswordNoEcho

I could implement this in a PR if it seems like an acceptable solution.

[dylanvaughn]

I ended up doing a slightly different approach of just checking if the old value of the parameter coming from AWS is **** - see #11707

[jsierles]

This issue still exists today, and the fix in the PR was never addressed. Does anyone have a workaround?

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.