backport of commit fa74710

pselle · pselle · commit ade378961ff9 · 2020-12-14T20:58:06.000Z
diff --git a/terraform/evaluate.go b/terraform/evaluate.go
@@ -433,7 +433,7 @@ func (d *evaluationStateData) GetModule(addr addrs.ModuleCall, rng tfdiags.Sourc
 
 			instance[cfg.Name] = outputState
 
-			if cfg.Sensitive {
+			if cfg.Sensitive && !outputState.HasMark("sensitive") {
 				instance[cfg.Name] = outputState.Mark("sensitive")
 			}
 		}
@@ -462,7 +462,7 @@ func (d *evaluationStateData) GetModule(addr addrs.ModuleCall, rng tfdiags.Sourc
 
 			instance[cfg.Name] = change.After
 
-			if change.Sensitive {
+			if change.Sensitive && !change.After.HasMark("sensitive") {
 				instance[cfg.Name] = change.After.Mark("sensitive")
 			}
 		}

Original file line number	Diff line number	Diff line change
`@@ -433,7 +433,7 @@ func (d *evaluationStateData) GetModule(addr addrs.ModuleCall, rng tfdiags.Sourc`
`433`	`433`
`434`	`434`	`instance[cfg.Name] = outputState`
`435`	`435`
`436`		`- if cfg.Sensitive {`
	`436`	`+ if cfg.Sensitive && !outputState.HasMark("sensitive") {`
`437`	`437`	`instance[cfg.Name] = outputState.Mark("sensitive")`
`438`	`438`	`}`
`439`	`439`	`}`
`@@ -462,7 +462,7 @@ func (d *evaluationStateData) GetModule(addr addrs.ModuleCall, rng tfdiags.Sourc`
`462`	`462`
`463`	`463`	`instance[cfg.Name] = change.After`
`464`	`464`
`465`		`- if change.Sensitive {`
	`465`	`+ if change.Sensitive && !change.After.HasMark("sensitive") {`
`466`	`466`	`instance[cfg.Name] = change.After.Mark("sensitive")`
`467`	`467`	`}`
`468`	`468`	`}`