AWX returns $encrypted$ and terraform stops trusting you

If you have used the AWX provider and hit this, you are not alone, it is the single most reported thing in the repository.

Error: Provider produced inconsistent result after apply

When applying changes to awx_settings_oidc.authentik, provider produced an
unexpected new value: .social_auth_oidc_secret: was cty.StringVal("abc123"),
but now cty.StringVal("$encrypted$").

You send a secret, AWX stores it, and when the provider reads the object back AWX hands over the literal string $encrypted$ instead of the value.

That is AWX being careful, and I think it’s the correct thing for an API to do.

It is also exactly the thing terraform treats as a provider lying to it, because the provider promised one value in the plan and produced a different one after the apply.

Notification templates do it with token, settings do it with anything holding a secret, and credentials do it with most of their inputs.

My first instinct was to write the planned value into state instead of whatever came back.

That works right up until somebody changes the secret outside terraform, at which point state confidently holds a value that isn’t true any more.

So what we do instead is mark those attributes as write only, which means the provider sends them and then never reads them back.

The plan value goes into the request, the plan value goes into state, and the $encrypted$ that AWX returns is dropped on the floor rather than compared against anything.

That means terraform cannot detect drift on those fields, which is a real cost and worth being honest about.

So there is no version of this where it can, because the API will not tell anyone what the value is, including the provider that set it.

• https://github.com/ilijamt/terraform-provider-awx