Answers: <p>When your configuration or a provider marks an attribute as sensitive, Terraform will always hide that value in any output that's intended for human consumption.</p>
  <p>The real values are available in machine-readable output though. This is primarily with the aim of integrating with external software, but if you need to then you can also inspect the machine-readable output directly yourself.</p>
  <p>You can get a machine-readable (JSON) rendering of a plan like this:</p>
  <pre><code>terraform plan -out=tfplan
  terraform show -json tfplan
  </code></pre>
  <p>If you intend to read it directly in the terminal then it can help to pipe it into <a href="https://stedolan.github.io/jq/" rel="noreferrer"><code>jq</code></a>, if you have that utility installed:</p>
  <pre><code>terraform show -json tfplan | jq
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2021-05-08T00:45:13.203Z
Answers: 2021-05-08T00:45:13.203Z
Answers: Martin Atkins
Body: <p>In a resource of type <code>aws_ecs_task_definition</code> my plan has an line that looks like this:</p>
  <pre><code>~ container_definitions    = (sensitive) # forces replacement
  </code></pre>
  <p>Now in principle this could be doing anything - deleting all my containers, spinning up bitcoin mining containers, etc.</p>
  <p>Is there any way I can look at the data, both the old and the new?</p>
  
Tags: <terraform><security>
Title: Terraform: how do you inspect sensitive data?
UserDisplayName: Carl Patenaude Poulin
ThreadText: # Terraform: how do you inspect sensitive data?
  
  (Asked by: username_0 on 2021-05-06)
  
  In a resource of type `aws_ecs_task_definition` my plan has an line that looks like this:
  
  ```
  ~ container_definitions    = (sensitive) # forces replacement
  
  ```
  
  Now in principle this could be doing anything - deleting all my containers, spinning up bitcoin mining containers, etc.
  
  Is there any way I can look at the data, both the old and the new?
  
  **Tags:** terraform, security
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2021-05-08. Score: 5 | Accepted answer
  
  When your configuration or a provider marks an attribute as sensitive, Terraform will always hide that value in any output that's intended for human consumption.
  
  The real values are available in machine-readable output though. This is primarily with the aim of integrating with external software, but if you need to then you can also inspect the machine-readable output directly yourself.
  
  You can get a machine-readable (JSON) rendering of a plan like this:
  
  ```
  terraform plan -out=tfplan
  terraform show -json tfplan
  
  ```
  
  If you intend to read it directly in the terminal then it can help to pipe it into [`jq`](https://stedolan.github.io/jq/), if you have that utility installed:
  
  ```
  terraform show -json tfplan | jq
  
  ```
  
  
  ---
  
  