Tfe_output: nonsensitive_values and missing attribute

Terraform HCP Terraform
1

Hello,
i must have done something odd, but i can’t figure out why the tfe_output returns a very different structure than usually. I appreciate you checking into this .

module 1:

data "aws_organizations_organization" "org" {}
output "org" {
  value = data.aws_organizations_organization.org
}

and the output is :

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

org = {
  "accounts" = tolist([
    {
      "arn" = "arn:aws:organizations::XXXXXXXXXX"
      "email" = "XXXXXX"
      "id" = "XXXXXXXXXX"
      "name" = "XXXXXXX"
      "status" = "ACTIVE"
    },
    {
      "arn" = "arn:aws:organizations::XXXXXXXXXX"
      "email" = "XXXXXX"
      "id" = "XXXXXXXXXX"
      "name" = "XXXXXXX"
      "status" = "ACTIVE"
    },

In the module 2:

data "tfe_outputs" "org" {
  organization = "XXXXX"
  workspace    = "XXXXX"
}
....
    for i, acc in data.tfe_outputs.org.accounts[*] :
...

Produces:

Error: Unsupported attribute
│ 
│   on cw_cross_account_obser.tf line 98, in locals:
│   98:     for i, acc in data.tfe_outputs.org.accounts[*] :
│ 
│ This object has no argument, nested block, or exported attribute named "accounts".
╵

with `terraform console --plan :

> data.tfe_outputs.org
{
  "id" = "XXXXX"
  "nonsensitive_values" = {
    "org" = {
      "accounts" = [
        {
          "arn" = "arn:aws:organizations::XXXXXXXX:account/XXXXXXXXXXXX"
          "email" = "XXXXXXXXXXXX"
          "id" = "XXXXXX"
          "name" = "XXXXXXX"
          "status" = "ACTIVE"
        },
.....
}
}
...
data.tfe_outputs.org.nonsensitive_values.org.arn
"arn:aws:organizations::XXXXXXXX:organization/XXXXXXX

What is the source of “nonsensitive_values” and why does it appears?

2

ohh… RTFM to the rescue…

I didn’t know this attribute is available. What is the assignment workflow for “nonsecure” vs “values”? In other words, when i export a value, how do i assign it to “secure” or non secure?

3

i think this document might need a facelift Output Values - Configuration Language | Terraform | HashiCorp Developer
I just realized it doesn’t have anything about accessing outputs from TFE.

5

The issue you’re experiencing with tfe_output stems from how Terraform Cloud (TFC) and Terraform Enterprise (TFE) handle output values, particularly with respect to sensitive and nonsensitive data. The nonsensitive_values attribute you’re encountering encapsulates outputs that are not marked as sensitive, separating them from any sensitive data to prevent unintentional exposure. The error (Unsupported attribute ) arises because Terraform does not recognize accounts as a direct attribute of data.tfe_outputs.org , likely due to the unexpected data structure caused by the nonsensitive_values wrapping.

6

@rtwolfe ,
thank you for the reply.

  1. How would i know when a value gets assigned to “Sensetive” and when to “nonsensetive”? Is there a way to know without explicitly examining the output?
  2. is there a reason that the documentation for “outputs” does not highlight this feature? I grew accustomed to TF providing a good quality documentation. Looks like an omission to me. But I’m probably wrong.
7

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.