title: Terraform plan prints sensitive information
body: <p>when performing <code>terraform plan</code>, if an <code>azurerm_kubernetes_cluster</code> (Azure) resource exists in the state, terraform will print some information from <code>kube_config</code> which seems sensitive</p>
  
  <p>Example printout: (all <code>...</code> values get printed)</p>
  
  <pre><code>kube_config = [
                  {
                      client_certificate = (...)
                      client_key = (...)
                      cluster_ca_certificate = (...)
                      host = (...)
                      password = (...)
                 }
  </code></pre>
  
  <p>I'm not exactly sure WHICH of those values are sensitive, but <code>password</code> probably is...right?</p>
  
  <p>On the other hand, terraform does seem to have <em>some</em> knowledge of which values are sensitive, as it does print the <code>client_secret</code> this way:</p>
  
  <pre><code>service_principal {
              client_id     = "(...)"
              client_secret = (sensitive value)
          }
  </code></pre>
  
  <p>So, my questions would be:</p>
  
  <ol>
  <li>Are those values actually sensitive?</li>
  <li>If so, is there a way to instruct terraform to mask those values in the plan?</li>
  </ol>
  
  <p>Versions we are using:</p>
  
  <pre><code>provider "azurerm" {
    version = "~&gt;1.37.0"
  }
  </code></pre>
  
  <p>The reason why this is problematic is that we pipe the plan in a Github PR comment.</p>
  
  <p>Thanks</p>