Sensitive value in output can't be read using tfe_outputs

[pj]

Terraform Cloud/Enterprise version

Terraform Cloud

Terraform version

Terraform v1.2.5                                                                                                                                                                     
on linux_amd64                                                                                                                                                                       
+ provider registry.terraform.io/hashicorp/tfe v0.30.2

Terraform Configuration Files

In workspace 1:

resource "random_password" "password" {
  length = 32
  special = true
}

output "password" {
  value = random_password.keycloak_password.result
  sensitive = true
}

In workspace 2:

data "tfe_outputs" "asdf" {
  organization = "my-org"
  workspace = "project-1"
}

output "password" {
  value = data.tfe_outputs.asdf.values
  sensitive = true
}

Expected Behavior

Running terraform output -json in workspace 2 should show the password from workspace 1.

Actual Behavior

Output of workspace 2:

> terraform output -json
{
  "password": {
    "sensitive": true,
    "type": [
      "object",
      {
        "password": "dynamic"
      }
    ],
    "value": {
      "password": null
    }
  }
}

Additional Context

This was also reported at https://github.com/hashicorp/terraform/issues/31234, there is more detail there. @spanktar

[annawinkler]

Thank you for submitting this issue! We'll take a look and get back to you about this. ✨

[annawinkler]

We have verified that this a bug and we're working on a fix. Thank you again for reporting this issue.

[rafitadiaz]

Maybe I'm not getting it but shouldn't you call be like this?

value = data.tfe_outputs.asdf.values.password

to qualify which output do you want to use?

[CJSmith-0141]

I'm also seeing this issue. Outputs marked sensitive in the source workspace are coming up as null in the workspace using tfe_outputs

[ispirals]

same here, switching to terraform_remote_state seems to work correctly to me but it is not what is desired

[brandonc]

I do believe this was fixed in v0.36.0