[0.14-rc1] Error: value has marks, so it cannot be serialized

[innovate-invent]

Terraform Version

0.14-rc1

Terraform Configuration Files

I need more information about this error before I can provide a reproducible test.

Debug Output

2020/11/13 19:16:29 [WARN] Provider "registry.terraform.io/terraform-providers/docker" produced an unexpected new value for module.islandcompare.docker_container.microbedb during refresh.
      - .links: was null, but now cty.SetValEmpty(cty.String)
      - .tmpfs: was null, but now cty.MapValEmpty(cty.String)
      - .dns: was null, but now cty.SetValEmpty(cty.String)
      - .log_opts: was null, but now cty.MapValEmpty(cty.String)
      - .dns_opts: was null, but now cty.SetValEmpty(cty.String)
      - .group_add: was null, but now cty.SetValEmpty(cty.String)
      - .sysctls: was null, but now cty.MapValEmpty(cty.String)
      - .dns_search: was null, but now cty.SetValEmpty(cty.String)
      - .devices: planned set element cty.ObjectVal(map[string]cty.Value{"container_path":cty.StringVal(""), "host_path":cty.StringVal("/dev/fuse"), "permissions":cty.StringVal("")}) does not correlate with any element in actual
2020-11-13T19:16:29.093-0800 [WARN]  plugin.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = transport is closing"
2020-11-13T19:16:29.094-0800 [DEBUG] plugin: plugin process exited: path=.terraform/providers/registry.terraform.io/hashicorp/random/3.0.0/linux_amd64/terraform-provider-random_v3.0.0_x5 pid=205487
2020-11-13T19:16:29.094-0800 [DEBUG] plugin: plugin exited
2020-11-13T19:16:29.096-0800 [DEBUG] plugin: plugin process exited: path=.terraform/providers/registry.terraform.io/terraform-providers/docker/2.7.2/linux_amd64/terraform-provider-docker_v2.7.2_x4 pid=205502
2020-11-13T19:16:29.096-0800 [DEBUG] plugin: plugin exited
2020-11-13T19:16:29.097-0800 [INFO]  plugin: configuring client automatic mTLS
2020-11-13T19:16:29.123-0800 [DEBUG] plugin: starting plugin: path=.terraform/providers/registry.terraform.io/brinkmanlab/galaxy/0.2.6/linux_amd64/terraform-provider-galaxy_v0.2.6 args=[.terraform/providers/registry.terraform.io/brinkmanlab/galaxy/0.2.6/linux_amd64/terraform-provider-galaxy_v0.2.6]
2020-11-13T19:16:29.123-0800 [DEBUG] plugin: plugin started: path=.terraform/providers/registry.terraform.io/brinkmanlab/galaxy/0.2.6/linux_amd64/terraform-provider-galaxy_v0.2.6 pid=205523
2020-11-13T19:16:29.123-0800 [DEBUG] plugin: waiting for RPC address: path=.terraform/providers/registry.terraform.io/brinkmanlab/galaxy/0.2.6/linux_amd64/terraform-provider-galaxy_v0.2.6
2020-11-13T19:16:29.128-0800 [INFO]  plugin.terraform-provider-galaxy_v0.2.6: configuring server automatic mTLS: timestamp=2020-11-13T19:16:29.128-0800
2020-11-13T19:16:29.158-0800 [DEBUG] plugin.terraform-provider-galaxy_v0.2.6: plugin address: address=/tmp/plugin004357902 network=unix timestamp=2020-11-13T19:16:29.158-0800
2020-11-13T19:16:29.158-0800 [DEBUG] plugin: using plugin: version=5
2020/11/13 19:16:29 [INFO] ReferenceTransformer: reference not found: "local.password"
2020/11/13 19:16:29 [INFO] ReferenceTransformer: reference not found: "var.username"
2020/11/13 19:16:29 [INFO] ReferenceTransformer: reference not found: "var.email"
2020/11/13 19:16:29 [DEBUG] ReferenceTransformer: "module.admin_user.galaxy_user.admin" references: []
module.admin_user.galaxy_user.admin: Refreshing state... [id=78a4cd42036d3137]
2020-11-13T19:16:29.301-0800 [DEBUG] plugin.terraform-provider-galaxy_v0.2.6: 2020/11/13 19:16:29 [DEBUG] <nil> 
2020-11-13T19:16:29.367-0800 [WARN]  plugin.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = transport is closing"
2020-11-13T19:16:29.369-0800 [DEBUG] plugin: plugin process exited: path=.terraform/providers/registry.terraform.io/brinkmanlab/galaxy/0.2.6/linux_amd64/terraform-provider-galaxy_v0.2.6 pid=205523
2020-11-13T19:16:29.369-0800 [DEBUG] plugin: plugin exited
2020-11-13T19:16:29.369-0800 [INFO]  plugin: configuring client automatic mTLS
2020-11-13T19:16:29.391-0800 [DEBUG] plugin: starting plugin: path=.terraform/providers/registry.terraform.io/brinkmanlab/galaxy/0.2.6/linux_amd64/terraform-provider-galaxy_v0.2.6 args=[.terraform/providers/registry.terraform.io/brinkmanlab/galaxy/0.2.6/linux_amd64/terraform-provider-galaxy_v0.2.6]
2020-11-13T19:16:29.391-0800 [DEBUG] plugin: plugin started: path=.terraform/providers/registry.terraform.io/brinkmanlab/galaxy/0.2.6/linux_amd64/terraform-provider-galaxy_v0.2.6 pid=205541
2020-11-13T19:16:29.391-0800 [DEBUG] plugin: waiting for RPC address: path=.terraform/providers/registry.terraform.io/brinkmanlab/galaxy/0.2.6/linux_amd64/terraform-provider-galaxy_v0.2.6
2020-11-13T19:16:29.396-0800 [INFO]  plugin.terraform-provider-galaxy_v0.2.6: configuring server automatic mTLS: timestamp=2020-11-13T19:16:29.396-0800
2020-11-13T19:16:29.419-0800 [DEBUG] plugin: using plugin: version=5
2020-11-13T19:16:29.419-0800 [DEBUG] plugin.terraform-provider-galaxy_v0.2.6: plugin address: address=/tmp/plugin843699250 network=unix timestamp=2020-11-13T19:16:29.419-0800
2020-11-13T19:16:29.471-0800 [DEBUG] plugin: plugin process exited: path=.terraform/providers/registry.terraform.io/brinkmanlab/galaxy/0.2.6/linux_amd64/terraform-provider-galaxy_v0.2.6 pid=205541
2020-11-13T19:16:29.471-0800 [DEBUG] plugin: plugin exited

Crash Output

Error: .apikey: value has marks, so it cannot be serialized

Expected Behavior

terraform plan succeeds

Actual Behavior

Error: .apikey: value has marks, so it cannot be serialized

Steps to Reproduce

Additional Context

I believe this is related to passing the api key to the 'brinkmanlab/galaxy' provider. The debug output does not provide enough information to narrow down the issue. I tried searching the terraform code for the error string but cant find it.

Relevent provider argument:
https://github.com/brinkmanlab/terraform-provider-galaxy/blob/38409dca3a03632f8d505508e85b479540bfa21a/galaxy/provider.go#L33-L40

[alisdair]

Thanks for reporting this, @innovate-invent. I was able to reproduce with this config:

variable "access_key_id" {
  type      = string
  sensitive = true
  default   = "foobar"
}

provider "aws" {
  access_key = var.access_key_id
  region     = "us-east-1"
}

data "aws_regions" "current" {}

Running terraform validate results in the same error:

Error: .access_key: value has marks, so it cannot be serialized

[PWM-BIA-TPA-PIE]

I am using Terraform v0.14.0 (not a RC). I am getting this message when marking a password variables as sensitive:

Error: .vars["db_password"]: value has marks, so it cannot be serialized

Does this mean that the "sensitive" parameter on variables isn't working quite yet?

[marshallford]

I ran into something similar -- Error: .environment["FOO_BAR"]: value has marks, so it cannot be serialized, specifically when marking the the variable as as sensitive in both the module I was consuming and in the root module where the variable was also defined.

@KyL0R3Nz0 Take a look at see if that is also your issue. Looks like this will fix it: #27148.

Lastly, I would like to know what the best practice is for sensitive variables in modules, once the backport lands. Should the variable be marked as sensitive "all the way down" or just in the root module?

[syl20bnr]

Same ting happens when using a value marked as sensitive in a data block:

data "external" "encrypted_secrets" {
  program  = [ "${path.module}/read_secrets.sh", var.passphrase, var.path]
}

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.