Update porter.yaml files to mask sensitive parameters

[JC-wk]

Resolves #5011

What is being addressed

Porter contains params as secrets which can leak in to log files

How is this addressed

• Set sensitive: true for all secrets
• Update CHANGELOG.md
• Increment template versions

[github-actions]

Unit Test Results

0 tests   0 ✅  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit 4bdb663.

♻️ This comment has been updated with latest results.

[Copilot]

Pull request overview

This PR mitigates accidental secret exposure in Porter/Terraform logs across Azure TRE templates by marking credential/parameter fields as sensitive, while bumping template versions and recording the change in the changelog.

Changes:

• Mark azure_client_secret (and where applicable auth_client_secret, client_secret, and airlock_request_sas_url) as sensitive: true in affected porter.yaml files.
• Increment template versions to reflect the change.
• Add a CHANGELOG entry referencing the fix.

Reviewed changes

Copilot reviewed 26 out of 26 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
templates/workspaces/unrestricted/porter.yaml	Mark workspace secrets as sensitive; bump template version.
templates/workspaces/base/porter.yaml	Mark workspace secrets as sensitive; bump template version.
templates/workspaces/airlock-import-review/porter.yaml	Mark workspace secrets as sensitive; bump template version.
templates/workspace_services/openai/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/ohdsi/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/mysql/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/health-services/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/gitea/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/databricks/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/azuresql/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/azureml/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/azureml/user_resources/aml_compute/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/guacamole/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/guacamole/user_resources/guacamole-azure-windowsvm/porter.yaml	Mark Azure/Auth client secrets as sensitive; bump version.
templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/porter.yaml	Mark Azure/Auth client secrets as sensitive; bump version.
templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm/porter.yaml	Mark Azure client secret and SAS URL parameter as sensitive; bump version.
templates/workspace_services/guacamole/user_resources/guacamole-azure-export-reviewvm/porter.yaml	Mark Azure client secret and SAS URL parameter as sensitive; bump version.
templates/shared_services/sonatype-nexus-vm/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/shared_services/gitea/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/shared_services/firewall/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/shared_services/databricks-auth/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/shared_services/cyclecloud/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/shared_services/certs/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/shared_services/airlock_notifier/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/shared_services/admin-vm/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
CHANGELOG.md	Document the security/logging fix under BUG FIXES.

[Copilot]

Pull request overview

Copilot reviewed 26 out of 26 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated no new comments.

[marrobi]

@JC-wk is this ready for review?

[JC-wk]

@JC-wk is this ready for review?

yes

[marrobi]

LGTM if it works.

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated no new comments.

[JC-wk]

@marrobi airlock_request_sas_url is the one that just needs a check/test since that is also now set in terraform

[marrobi]

@marrobi airlock_request_sas_url is the one that just needs a check/test since that is also now set in terraform

Will test.

[marrobi]

@JC-wk happy to merge, Opus did a small local check with some TF:

---

Tested the airlock_request_sas_url change specifically (the one flagged as also being set in Terraform). No live deployment — validated the Terraform sensitivity handling locally, since the concern was whether marking the variable sensitive breaks how the SAS URL is rendered into the review VM's bootstrap script.

What I checked:

terraform validate on the import-reviewvm root module and its vm submodule — both valid.

Sensitivity propagation — the SAS URL flows: var.airlock_request_sas_url (sensitive = true) → templatefile(download_review_data.ps1) → base64encode(join(compact([...]))) → VM custom_data. I replicated this exact pattern in a throwaway config and confirmed:

terraform apply succeeds with no "sensitive value" / invalid-context error.
The base64-decoded custom_data still contains the real SAS URL (incl. the sig= token). sensitive only masks it in plan/log output — it does not redact the value the VM actually needs to download the review data.
No leaks — neither review VM's outputs.tf exposes the SAS URL / review_data_script / custom_data.

Parity — porter sensitive: true matches Terraform sensitive = true for both import and export review VMs.

✅ Marking airlock_request_sas_url sensitive is safe — it validates, renders correctly, and the token still reaches the VM. Note this PR only added sensitive = true to the import reviewvm's variables.tf; the export one already had it, so both are now consistent.

I did not run a full end-to-end deploy (TRE + workspace + Guacamole + an in-review airlock import request provisioning an actual review VM). Happy to do that if we want live confirmation.

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated no new comments.

Suppressed comments (1)

templates/shared_services/certs/porter.yaml:18

• This bundle changes its manifest but, unlike the other modified templates, still declares version 0.7.11. Publishing under the unchanged version can leave existing deployments on the artifact without this redaction metadata. Increment the patch version for this bundle as well.

    sensitive: true

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated no new comments.

Suppressed comments (1)

CHANGELOG.md:20

• The entry omits the 25 bundle versions changed by this PR. Bundle version updates must be documented in the changelog so operators can identify which resource versions contain the fix; please add the affected bundle names and their new versions (splitting the entry if needed), as the adjacent entry does on line 21.

* Mark secret parameters in porter.yaml as `sensitive: true` to prevent secrets from appearing in debug logs ([#5011](https://github.com/microsoft/AzureTRE/issues/5011))