Variables parameter set to no_log=True

[tuxpreacher]

SUMMARY

The variables parameter often includes sensitive data. While no_log=true can be set on the task level (as suggested in the module's documentation), this hinders efforts to debug module usage during the plan or apply stages of Terraform. It would make more sense just to define the variables parameters to be hidden (as some other Ansible modules do).

Based on AAPRFE-1929.

ISSUE TYPE

• Feature Pull Request

COMPONENT NAME

cloud.terraform.terraform

ADDITIONAL INFORMATION

An even better solution would be to have a new parameter which could switch the variables visibility to on/off. I'd need some help with that though.

[softwarefactory-project-zuul]

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/2824fff16eac421993d83e858f14c567

✔️ ansible-galaxy-importer SUCCESS in 11m 31s
✔️ build-ansible-collection SUCCESS in 5m 46s

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 80.09%. Comparing base (8c52bf2) to head (8a873b5).
Report is 25 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #170      +/-   ##
==========================================
+ Coverage   73.00%   80.09%   +7.08%     
==========================================
  Files          16       23       +7     
  Lines        1015     1522     +507     
  Branches      182      274      +92     
==========================================
+ Hits          741     1219     +478     
- Misses        243      262      +19     
- Partials       31       41      +10     

Flag	Coverage Δ
sanity	?
units	80.09% <ø> (+7.48%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[abikouo]

This requires a changelog, and the linters workflow should be fixed, but this is not related to this PR

[gravesm]

This will need a changelog.

Maybe I'm not fully understanding the issue, but isn't this change going to make it even harder to debug? Setting no_log at the module level can't be overridden.

[tuxpreacher]

Changelog added. @gravesm sometimes debugging doesn't require debugging the modules variables parameter. This would allow users not to have to obscure everything by using no_log=true at the task level, they could just have it at the variables level.

[softwarefactory-project-zuul]

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/d40e2075c71a45328db0d20ba76127ce

✔️ ansible-galaxy-importer SUCCESS in 3m 12s
✔️ build-ansible-collection SUCCESS in 5m 21s