From 649c732446616c4445d870c7a309baaea0c9cb4d Mon Sep 17 00:00:00 2001 From: Irving Popovetsky Date: Thu, 22 Oct 2026 05:41:34 -0700 Subject: [PATCH] Mark ECS AMI as nonsensitive and output the AMI name The AWS provider marks all aws_ssm_parameter values as sensitive, which hid the AMI ID in plans. The ECS-optimized AMI parameter is public, so wrap it in nonsensitive() and expose the AMI name as an output. Co-Authored-By: Claude Opus 5.5 --- terraform/asg.tf | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/terraform/asg.tf b/terraform/asg.tf index 4d59943..08f98ec 100644 --- a/terraform/asg.tf +++ b/terraform/asg.tf @@ -5,6 +5,17 @@ data "aws_ssm_parameter" "ecs_optimized_ami" { name = "/aws/service/ecs/optimized-ami/amazon-linux-2023/arm64/recommended" } +# The provider marks SSM values as sensitive, but public AMI IDs are not secret +locals { + ecs_ami = nonsensitive(jsondecode(data.aws_ssm_parameter.ecs_optimized_ami.value)) + ecs_ami_id = local.ecs_ami["image_id"] +} + +output "ecs_ami_name" { + description = "ECS-optimized AMI name used by the autoscaling launch template" + value = local.ecs_ami["image_name"] +} + # https://registry.terraform.io/modules/terraform-aws-modules/autoscaling/aws/latest module "autoscaling" { source = "terraform-aws-modules/autoscaling/aws" @@ -58,7 +69,7 @@ module "autoscaling" { # ] } - image_id = jsondecode(data.aws_ssm_parameter.ecs_optimized_ami.value)["image_id"] + image_id = local.ecs_ami_id user_data = base64encode(local.user_data) ignore_desired_capacity_changes = true key_name = "oc-ops"