Noise is generated in terraform plan for OAuthToken

[huksley]

Using terraform-aws-cicd and getting the source code from the private repo in GitHub,
and everything is applied already
whenever one executes plan, terraform wants to change OAuthToken every time

Output of terraform plan

  ~ module.build_frontend.aws_codepipeline.source_build
      stage.0.action.0.configuration.%:          "4" => "5"
      stage.0.action.0.configuration.OAuthToken: "" => "deadbeefdeadbeefdeadbeefdeadbeefdeadbeef"

Usage

module "build_frontend" {
    source              = "github.com/cloudposse/terraform-aws-cicd?ref=master"
    namespace           = "${var.namespace}"
    name                = "${var.frontend}"
    stage               = "${var.stage}"
    enabled             = "true"
    github_oauth_token  = "${var.github_oauth_token}"
    repo_owner          = "${var.github_group}"
    repo_name           = "${var.github_project_frontend}"
    branch              = "${var.github_branch_frontend}"
    build_image         = "aws/codebuild/nodejs:8.11.0"
    build_compute_type  = "BUILD_GENERAL1_SMALL"
    aws_region          = "${var.aws_region}"
    aws_account_id      = "${var.aws_account_id}"
}

Probably a reason for this is OAuthToken can be only set, not read in AWS CodePipeline.
Are there any approaches to this to have "clean" plan without any changes?

From https://www.terraform.io/docs/providers/aws/r/codepipeline.html:

NOTE on aws_codepipeline: - the GITHUB_TOKEN environment variable must be set if the GitHub provider is specified.

Tried that, nothing happens...

[huksley]

The issue in terraform aws provider,
hashicorp/terraform-provider-aws#2854

[osterman]

Yes, we have seen the same behavior since day one. IMO, terraform should treat it's statefile as the "canonical source of truth" for settings which cannot be read. E.g. RDS passwords, GitHub tokens, etc. That way it could optimistically detect changes. Would love a clever workaround if someone has it.

[osterman]

Just riffing here... what about always ignoring the token in the lifecycle section, but using AWS secrets manager to set the token?

[JagoMar]

I don't know the status of this. However, I am using SSM securestrings to provide the github OAuth and I still see the same consistent changes (This is due the previously pointed issue).

[itdataguy]

Just riffing here... what about always ignoring the token in the lifecycle section, but using AWS secrets manager to set the token?

This worked for me:

lifecycle {
    ignore_changes = [
      "stage.0.action.0.configuration.%",
      "stage.0.action.0.configuration.OAuthToken",
    ]
  }