random_password.bcrypt_hash is incorrect since 3.4.0

[marcus-bcl]

Terraform CLI and Provider Versions

Terraform v1.2.8
on linux_amd64

• provider registry.terraform.io/hashicorp/random v3.4.0

Terraform Configuration

resource "random_password" "password" {
  length  = 32
}

output "result" {
  value = random_password.password.result
  sensitive = true
}

# THIS DOES NOT WORK
output "bcrypt_hash" {
  value = random_password.password.bcrypt_hash
  sensitive = true
}

# THIS WORKS
output "function_hash" {
  value = bcrypt(random_password.password.result)
  sensitive = true
}

Expected Behavior

The result output can be verified against the bcrypt_hash output, e.g. using https://gchq.github.io/CyberChef/#recipe=Bcrypt_compare('')

Actual Behavior

The bcrypt_hash is not a valid hash of result.

Steps to Reproduce

1. terraform apply
2. terraform output bcrypt_hash
3. terraform output result
4. Check whether bcrypt_hash is a valid hash of result

How much impact is this issue causing?

Medium

Logs

No response

Additional Information

This worked in 3.3.2, but is broken in 3.4.0+.

Note: the bcrypt(...) function still works as expected, however generates a new hash on each apply. The following workaround can be used to get a static hash:

resource "null_resource" "password" {
  triggers = {
    result = random_password.password.result
    bcrypt_hash = bcrypt(random_password.password.result)
  }
  lifecycle {
    ignore_changes = [triggers["bcrypt_hash"]]
  }
}

output "bcrypt_hash" {
  value = null_resource.password.triggers["bcrypt_hash"]
}

Code of Conduct

• I agree to follow this project's Code of Conduct

[bflad]

Hi @marcus-bcl 👋 Thank you for raising this and sorry you are running into trouble with this. I have been able to reproduce on 3.4.2 and believe I found a root cause. I will ensure there is additional testing for this functionality and submit a fix for it shortly.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.