Allow sensitive values to be read from stack

Currently the only way to read sensitive values from a stack is to running a task that runs tofu output <output name> . This works - but has a major flaw, it exposes the sensitive output value to anyone who has read only on the stack.

We’d like a way to directly view sensitive outputs in the stack UI (and potentially via tools like spacectl) which is locked behind a more privileged permission than Read only. This could be stack write or (better) a specific, new permission for viewing sensitive outputs.

Workaround

Currently our workaround is for users who need these outputs to run tofu output locally on their workstation, requiring them to auth to AWS so they can read the state from S3. https://feedback.spacelift.io/p/granular-access-for-tasks would be a workaround for now if implemented but would still be a slightly clunky workflow

Problem

We have various stacks that create resources (e.g. RDS instances, Entra applications) that have sensitive outputs (master passwords, client secrets etc) that are required out of band for configuring other systems. Our current practice for this is to expose them as a sensitive output and then have a human read that output and configure the downstream systems appropriately. We are aware of the risks this carries in terms of sensitive values in the state in S3 etc and have things in place to mitigate this risk. By design all of our Spacelift users have read only over all stacks, which makes the current way of reading sensitive values using a task impossible for our use case (it would expose the sensitive output to all users)

Please authenticate to join the conversation.

Upvoters

Status

👀 In Review

Board

💡 Feature Requests

Subscribe to post