<p>When your configuration or a provider marks an attribute as sensitive, Terraform will always hide that value in any output that's intended for human consumption.</p>
<p>The real values are available in machine-readable output though. This is primarily with the aim of integrating with external software, but if you need to then you can also inspect the machine-readable output directly yourself.</p>
<p>You can get a machine-readable (JSON) rendering of a plan like this:</p>
<pre><code>terraform plan -out=tfplan
terraform show -json tfplan
</code></pre>
<p>If you intend to read it directly in the terminal then it can help to pipe it into <a href="https://stedolan.github.io/jq/" rel="noreferrer"><code>jq</code></a>, if you have that utility installed:</p>
<pre><code>terraform show -json tfplan | jq
</code></pre>

CC BY-SA 4.0
2021-05-08T00:45:13.203Z
2021-05-08T00:45:13.203Z
Martin Atkins
<p>In a resource of type <code>aws_ecs_task_definition</code> my plan has an line that looks like this:</p>
<pre><code>~ container_definitions    = (sensitive) # forces replacement
</code></pre>
<p>Now in principle this could be doing anything - deleting all my containers, spinning up bitcoin mining containers, etc.</p>
<p>Is there any way I can look at the data, both the old and the new?</p>

<terraform><security>
Terraform: how do you inspect sensitive data?
Carl Patenaude Poulin
# Terraform: how do you inspect sensitive data?

(Asked by: username_0 on 2021-05-06)

In a resource of type aws_ecs_task_definition my plan has an line that looks like this:
~ container_definitions    = (sensitive) # forces replacement

Now in principle this could be doing anything - deleting all my containers, spinning up bitcoin mining containers, etc.
Is there any way I can look at the data, both the old and the new?

**Tags:** terraform, security


---

## 1 answers

### Answer by username_1 on 2021-05-08. Score: 5 | Accepted answer

When your configuration or a provider marks an attribute as sensitive, Terraform will always hide that value in any output that's intended for human consumption.
The real values are available in machine-readable output though. This is primarily with the aim of integrating with external software, but if you need to then you can also inspect the machine-readable output directly yourself.
You can get a machine-readable (JSON) rendering of a plan like this:
terraform plan -out=tfplan
terraform show -json tfplan

If you intend to read it directly in the terminal then it can help to pipe it into jq, if you have that utility installed:
terraform show -json tfplan | jq


---

