From 05e81a07a022c6e349d6ec91875afbd4a4fae186 Mon Sep 17 00:00:00 2001 From: Nayyar Date: Tue, 8 Sep 2026 23:34:35 +0530 Subject: [PATCH] mark plaintext credential fields as sensitive across resources --- mmv1/products/cloudbuild/BitbucketServerConfig.yaml | 1 + mmv1/products/datastream/ConnectionProfile.yaml | 3 +++ mmv1/products/developerconnect/AccountConnector.yaml | 1 + mmv1/products/dialogflow/Environment.yaml | 1 + mmv1/products/dialogflow/Fulfillment.yaml | 1 + mmv1/products/dialogflowcx/Webhook.yaml | 2 ++ .../identityplatform/DefaultSupportedIdpConfig.yaml | 1 + mmv1/products/identityplatform/OauthIdpConfig.yaml | 1 + .../TenantDefaultSupportedIdpConfig.yaml | 1 + mmv1/products/identityplatform/TenantOauthIdpConfig.yaml | 1 + mmv1/products/integrations/AuthConfig.yaml | 9 +++++++++ mmv1/products/looker/Instance.yaml | 1 + .../apigee/resource_apigee_keystores_aliases_pkcs12.go | 1 + .../data_source_google_vmwareengine_nsx_credentials.go | 1 + ...ata_source_google_vmwareengine_vcenter_credentials.go | 1 + 15 files changed, 26 insertions(+) diff --git a/mmv1/products/cloudbuild/BitbucketServerConfig.yaml b/mmv1/products/cloudbuild/BitbucketServerConfig.yaml index d3346b52e378..d7615f9dd384 100644 --- a/mmv1/products/cloudbuild/BitbucketServerConfig.yaml +++ b/mmv1/products/cloudbuild/BitbucketServerConfig.yaml @@ -126,6 +126,7 @@ properties: description: | Immutable. API Key that will be attached to webhook. Once this field has been set, it cannot be changed. Changing this field will result in deleting/ recreating the resource. + sensitive: true immutable: true - name: connectedRepositories type: Array diff --git a/mmv1/products/datastream/ConnectionProfile.yaml b/mmv1/products/datastream/ConnectionProfile.yaml index e8950807dd61..2af56d38dbce 100644 --- a/mmv1/products/datastream/ConnectionProfile.yaml +++ b/mmv1/products/datastream/ConnectionProfile.yaml @@ -524,10 +524,12 @@ properties: type: String description: | Password of the user. + sensitive: true - name: securityToken type: String description: | Security token of the user. + sensitive: true - name: secretManagerStoredPassword type: String description: | @@ -552,6 +554,7 @@ properties: type: String description: | Client secret to use for authentication. + sensitive: true - name: secretManagerStoredClientSecret type: String description: | diff --git a/mmv1/products/developerconnect/AccountConnector.yaml b/mmv1/products/developerconnect/AccountConnector.yaml index 6c8ddf87dd71..cc6d11449d86 100644 --- a/mmv1/products/developerconnect/AccountConnector.yaml +++ b/mmv1/products/developerconnect/AccountConnector.yaml @@ -118,6 +118,7 @@ properties: Input only. The client secret of the OAuth application. It will be provided as plain text, but encrypted and stored in developer connect. As INPUT_ONLY field, it will not be included in the output. + sensitive: true - name: hostUri type: String required: true diff --git a/mmv1/products/dialogflow/Environment.yaml b/mmv1/products/dialogflow/Environment.yaml index 1ac43c062590..319e21d2dcee 100644 --- a/mmv1/products/dialogflow/Environment.yaml +++ b/mmv1/products/dialogflow/Environment.yaml @@ -183,6 +183,7 @@ properties: type: String description: | The password for HTTP Basic authentication. + sensitive: true - name: requestHeaders type: KeyValuePairs description: | diff --git a/mmv1/products/dialogflow/Fulfillment.yaml b/mmv1/products/dialogflow/Fulfillment.yaml index 19a90de6c948..78217be9c5d5 100644 --- a/mmv1/products/dialogflow/Fulfillment.yaml +++ b/mmv1/products/dialogflow/Fulfillment.yaml @@ -98,6 +98,7 @@ properties: type: String description: | The password for HTTP Basic authentication. + sensitive: true - name: requestHeaders type: KeyValuePairs description: | diff --git a/mmv1/products/dialogflowcx/Webhook.yaml b/mmv1/products/dialogflowcx/Webhook.yaml index fe800331b196..b54da5cf83f2 100644 --- a/mmv1/products/dialogflowcx/Webhook.yaml +++ b/mmv1/products/dialogflowcx/Webhook.yaml @@ -156,6 +156,7 @@ properties: The client secret provided by the 3rd party platform. If the `secret_version_for_client_secret` field is set, this field will be ignored. + sensitive: true ignore_read: true - name: scopes type: Array @@ -307,6 +308,7 @@ properties: The client secret provided by the 3rd party platform. If the `secret_version_for_client_secret` field is set, this field will be ignored. + sensitive: true ignore_read: true - name: scopes type: Array diff --git a/mmv1/products/identityplatform/DefaultSupportedIdpConfig.yaml b/mmv1/products/identityplatform/DefaultSupportedIdpConfig.yaml index b94dbe807e7e..7700bf025298 100644 --- a/mmv1/products/identityplatform/DefaultSupportedIdpConfig.yaml +++ b/mmv1/products/identityplatform/DefaultSupportedIdpConfig.yaml @@ -84,6 +84,7 @@ properties: type: String description: | OAuth client secret + sensitive: true required: true - name: enabled type: Boolean diff --git a/mmv1/products/identityplatform/OauthIdpConfig.yaml b/mmv1/products/identityplatform/OauthIdpConfig.yaml index 13bdabc0c6d1..5137365a049a 100644 --- a/mmv1/products/identityplatform/OauthIdpConfig.yaml +++ b/mmv1/products/identityplatform/OauthIdpConfig.yaml @@ -75,6 +75,7 @@ properties: type: String description: | The client secret of the OAuth client, to enable OIDC code flow. + sensitive: true - name: responseType type: NestedObject description: | diff --git a/mmv1/products/identityplatform/TenantDefaultSupportedIdpConfig.yaml b/mmv1/products/identityplatform/TenantDefaultSupportedIdpConfig.yaml index e4b29297ef76..984c405a2096 100644 --- a/mmv1/products/identityplatform/TenantDefaultSupportedIdpConfig.yaml +++ b/mmv1/products/identityplatform/TenantDefaultSupportedIdpConfig.yaml @@ -89,6 +89,7 @@ properties: type: String description: | OAuth client secret + sensitive: true required: true - name: enabled type: Boolean diff --git a/mmv1/products/identityplatform/TenantOauthIdpConfig.yaml b/mmv1/products/identityplatform/TenantOauthIdpConfig.yaml index a53c7a23ac77..76e82c7fc4c0 100644 --- a/mmv1/products/identityplatform/TenantOauthIdpConfig.yaml +++ b/mmv1/products/identityplatform/TenantOauthIdpConfig.yaml @@ -79,3 +79,4 @@ properties: type: String description: | The client secret of the OAuth client, to enable OIDC code flow. + sensitive: true diff --git a/mmv1/products/integrations/AuthConfig.yaml b/mmv1/products/integrations/AuthConfig.yaml index b8860d71fc4f..866355d5bdb9 100644 --- a/mmv1/products/integrations/AuthConfig.yaml +++ b/mmv1/products/integrations/AuthConfig.yaml @@ -290,6 +290,7 @@ properties: type: String description: | Password to be used. + sensitive: true - name: oauth2AuthorizationCode type: NestedObject description: | @@ -310,6 +311,7 @@ properties: type: String description: | The client's secret. + sensitive: true - name: scope type: String description: | @@ -342,6 +344,7 @@ properties: type: String description: | The client's secret. + sensitive: true - name: tokenEndpoint type: String description: | @@ -429,10 +432,12 @@ properties: type: String description: | User's pre-shared secret to sign the token. + sensitive: true - name: jwt type: String description: | The token calculated by the header, payload and signature. + sensitive: true output: true - name: authToken type: NestedObject @@ -454,6 +459,7 @@ properties: type: String description: | The token for the auth type. + sensitive: true - name: serviceAccountCredentials type: NestedObject description: | @@ -498,6 +504,7 @@ properties: type: String description: | ID token obtained for the service account. + sensitive: true output: true - name: tokenExpireTime type: String @@ -521,9 +528,11 @@ properties: type: String description: | The ssl certificate encoded in PEM format. This string must include the begin header and end footer lines. + sensitive: true required: true - name: passphrase type: String description: | 'passphrase' should be left unset if private key is not encrypted. Note that 'passphrase' is not the password for web server, but an extra layer of security to protected private key. + sensitive: true diff --git a/mmv1/products/looker/Instance.yaml b/mmv1/products/looker/Instance.yaml index 6bc4afc6b061..9093ddced9ad 100644 --- a/mmv1/products/looker/Instance.yaml +++ b/mmv1/products/looker/Instance.yaml @@ -450,6 +450,7 @@ properties: type: String description: | The client secret for the Oauth config. + sensitive: true required: true # Oauth Object - End # Periodic Export Config Object diff --git a/mmv1/third_party/terraform/services/apigee/resource_apigee_keystores_aliases_pkcs12.go b/mmv1/third_party/terraform/services/apigee/resource_apigee_keystores_aliases_pkcs12.go index b94ee013e485..b6e3019255c7 100644 --- a/mmv1/third_party/terraform/services/apigee/resource_apigee_keystores_aliases_pkcs12.go +++ b/mmv1/third_party/terraform/services/apigee/resource_apigee_keystores_aliases_pkcs12.go @@ -155,6 +155,7 @@ Flag is set to Yes if the certificate is valid, No if expired, or Not yet if not Type: schema.TypeString, Optional: true, Computed: true, + Sensitive: true, Description: `Password for the Private Key if it's encrypted`, }, "type": { diff --git a/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_nsx_credentials.go b/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_nsx_credentials.go index 7b327b83590c..ea816cc05d79 100644 --- a/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_nsx_credentials.go +++ b/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_nsx_credentials.go @@ -29,6 +29,7 @@ For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud`, "password": { Type: schema.TypeString, Computed: true, + Sensitive: true, Description: `Initial password.`, }, }, diff --git a/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_vcenter_credentials.go b/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_vcenter_credentials.go index a87cb80149b6..8a9487b46b77 100644 --- a/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_vcenter_credentials.go +++ b/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_vcenter_credentials.go @@ -30,6 +30,7 @@ For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud`, "password": { Type: schema.TypeString, Computed: true, + Sensitive: true, Description: `Initial password.`, }, },