Why environment variable values show as "(sensitive value)" in Terraform plans

When using the spacelift_environment_variable resource in your Terraform configuration, you may notice that the value field always appears as (sensitive value) in Terraform plans, even when write_only = false and the variable isn't actually sensitive.

Why this happens

This behavior occurs because the value field of spacelift_environment_variable is defined as sensitive in the Spacelift Terraform provider schema. Terraform will always render sensitive fields as (sensitive value) in plans, regardless of the write_only setting or whether the variable contains secret information.

Solution: Use write-only attributes

To work around this limitation, you can use the newer write-only attributes that were introduced to address this issue:

• value_wo - a write-only attribute that sends the value to Spacelift without persisting it in state (requires Terraform/OpenTofu 1.11+)

• value_wo_version - an integer you increment to trigger updates when the value changes

Migration example

You can migrate from the value attribute to the write-only attributes like this:

Before:

resource "spacelift_environment_variable" "example" {
  name       = "TF_VAR_example"
  stack_id   = spacelift_stack.example.id
  value      = "my-value"
  write_only = false
}

After:

resource "spacelift_environment_variable" "example" {
  name             = "TF_VAR_example"
  stack_id         = spacelift_stack.example.id
  value_wo         = "my-value"
  value_wo_version = 1
  write_only       = false
}

When you need to update the value, increment the value_wo_version number to trigger the update.