Provider can not resolve sensitive data

[benkeil]

Description of the bug:

When TerraformOutput contains sensitive data, the resulting properties of the secret are omitted.

Reproduction Steps:

DataKeepassEntry.Builder.create(this, "DataKeepassEntry_PAPERLESS_ADMIN_USER")
        .path("Root/PAPERLESS_ADMIN_USER")
        .build()
        .also {
          paperlessAdminUser =
              Fn.tostring(
                  TerraformOutput.Builder.create(this, "PAPERLESS_ADMIN_USER")
                      .value(it.password)
                      .sensitive(true)
                      .build()
                      .value)

...

Secret.Builder.create(this, "secret")
            .stringData(
                mapOf(
                    "PAPERLESS_SECRET_KEY" to config.paperlessSecretKey,
                    "PAPERLESS_ADMIN_USER" to config.paperlessAdminUser,
                    "PAPERLESS_ADMIN_PASSWORD" to config.paperlessAdminPassword,
                ))
            .build()

Result

apiVersion: v1
kind: Secret
metadata:
  name: paperless-secret-c89e4b62
  namespace: paperless
immutable: false
stringData: {}

Error Log:

Environment:

• Framework Version:
• OS:

Other:

---

This is 🐛 Bug Report

[iliapolo]

Thanks for reporting this. Indeed, to include sensitive data we need to add the --outputs-file-include-sensitive-outputs option when the resolver fetches outputs. See https://developer.hashicorp.com/terraform/cdktf/cli-reference/commands#output.

We should provide this as an option to the resolver.