mark plaintext credential fields as sensitive across resources

mmv1/products/cloudbuild/BitbucketServerConfig.yaml

@@ -126,6 +126,7 @@ properties:
     description: |
       Immutable. API Key that will be attached to webhook. Once this field has been set, it cannot be changed.
       Changing this field will result in deleting/ recreating the resource.
+    sensitive: true
     immutable: true
   - name: connectedRepositories
     type: Array

mmv1/products/datastream/ConnectionProfile.yaml

@@ -524,10 +524,12 @@ properties:
             type: String
             description: |
               Password of the user.
+            sensitive: true
           - name: securityToken
             type: String
             description: |
               Security token of the user.
+            sensitive: true
           - name: secretManagerStoredPassword
             type: String
             description: |
@@ -552,6 +554,7 @@ properties:
             type: String
             description: |
               Client secret to use for authentication.
+            sensitive: true
           - name: secretManagerStoredClientSecret
             type: String
             description: |

mmv1/products/developerconnect/AccountConnector.yaml

@@ -118,6 +118,7 @@ properties:
           Input only. The client secret of the OAuth application.
           It will be provided as plain text, but encrypted and stored in developer
           connect. As INPUT_ONLY field, it will not be included in the output.
+        sensitive: true
       - name: hostUri
         type: String
         required: true

mmv1/products/dialogflow/Environment.yaml

@@ -183,6 +183,7 @@ properties:
             type: String
             description: |
               The password for HTTP Basic authentication.
+            sensitive: true
           - name: requestHeaders
             type: KeyValuePairs
             description: |

mmv1/products/dialogflow/Fulfillment.yaml

@@ -98,6 +98,7 @@ properties:
         type: String
         description: |
           The password for HTTP Basic authentication.
+        sensitive: true
       - name: requestHeaders
         type: KeyValuePairs
         description: |

mmv1/products/dialogflowcx/Webhook.yaml

@@ -156,6 +156,7 @@ properties:
               The client secret provided by the 3rd party platform.  If the
               `secret_version_for_client_secret` field is set, this field will be
               ignored.
+            sensitive: true
             ignore_read: true
           - name: scopes
             type: Array
@@ -307,6 +308,7 @@ properties:
                   The client secret provided by the 3rd party platform.  If the
                   `secret_version_for_client_secret` field is set, this field will be
                   ignored.
+                sensitive: true
                 ignore_read: true
               - name: scopes
                 type: Array

mmv1/products/identityplatform/DefaultSupportedIdpConfig.yaml

@@ -84,6 +84,7 @@ properties:
     type: String
     description: |
       OAuth client secret
+    sensitive: true
     required: true
   - name: enabled
     type: Boolean

mmv1/products/identityplatform/OauthIdpConfig.yaml

@@ -75,6 +75,7 @@ properties:
     type: String
     description: |
       The client secret of the OAuth client, to enable OIDC code flow.
+    sensitive: true
   - name: responseType
     type: NestedObject
     description: |

mmv1/products/identityplatform/TenantDefaultSupportedIdpConfig.yaml

@@ -89,6 +89,7 @@ properties:
     type: String
     description: |
       OAuth client secret
+    sensitive: true
     required: true
   - name: enabled
     type: Boolean

mmv1/products/identityplatform/TenantOauthIdpConfig.yaml

@@ -79,3 +79,4 @@ properties:
     type: String
     description: |
       The client secret of the OAuth client, to enable OIDC code flow.
+    sensitive: true

mmv1/products/integrations/AuthConfig.yaml

@@ -290,6 +290,7 @@ properties:
             type: String
             description: |
               Password to be used.
+            sensitive: true
       - name: oauth2AuthorizationCode
         type: NestedObject
         description: |
@@ -310,6 +311,7 @@ properties:
             type: String
             description: |
               The client's secret.
+            sensitive: true
           - name: scope
             type: String
             description: |
@@ -342,6 +344,7 @@ properties:
             type: String
             description: |
               The client's secret.
+            sensitive: true
           - name: tokenEndpoint
             type: String
             description: |
@@ -429,10 +432,12 @@ properties:
             type: String
             description: |
               User's pre-shared secret to sign the token.
+            sensitive: true
           - name: jwt
             type: String
             description: |
               The token calculated by the header, payload and signature.
+            sensitive: true
             output: true
       - name: authToken
         type: NestedObject
@@ -454,6 +459,7 @@ properties:
             type: String
             description: |
               The token for the auth type.
+            sensitive: true
       - name: serviceAccountCredentials
         type: NestedObject
         description: |
@@ -498,6 +504,7 @@ properties:
             type: String
             description: |
               ID token obtained for the service account.
+            sensitive: true
             output: true
           - name: tokenExpireTime
             type: String
@@ -521,9 +528,11 @@ properties:
         type: String
         description: |
           The ssl certificate encoded in PEM format. This string must include the begin header and end footer lines.
+        sensitive: true
         required: true
       - name: passphrase
         type: String
         description: |
           'passphrase' should be left unset if private key is not encrypted.
           Note that 'passphrase' is not the password for web server, but an extra layer of security to protected private key.
+        sensitive: true

mmv1/products/looker/Instance.yaml

@@ -450,6 +450,7 @@ properties:
         type: String
         description: |
           The client secret for the Oauth config.
+        sensitive: true
         required: true
   # Oauth Object - End
   # Periodic Export Config Object

mmv1/third_party/terraform/services/apigee/resource_apigee_keystores_aliases_pkcs12.go

@@ -155,6 +155,7 @@ Flag is set to Yes if the certificate is valid, No if expired, or Not yet if not
 				Type:        schema.TypeString,
 				Optional:    true,
 				Computed:    true,
+				Sensitive:   true,
 				Description: `Password for the Private Key if it's encrypted`,
 			},
 			"type": {

mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_nsx_credentials.go

@@ -29,6 +29,7 @@ For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud`,
 			"password": {
 				Type:        schema.TypeString,
 				Computed:    true,
+				Sensitive:   true,
 				Description: `Initial password.`,
 			},
 		},

mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_vcenter_credentials.go

@@ -30,6 +30,7 @@ For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud`,
 			"password": {
 				Type:        schema.TypeString,
 				Computed:    true,
+				Sensitive:   true,
 				Description: `Initial password.`,
 			},
 		},