Update porter.yaml files to mask sensitive parameters

[JC-wk]

Resolves #5011

What is being addressed

Porter contains params as secrets which can leak in to log files

How is this addressed

• Set sensitive: true for all secrets
• Update CHANGELOG.md
• Increment template versions

[github-actions]

Unit Test Results

0 tests   0 ✅  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit 94bb5cb.

♻️ This comment has been updated with latest results.

[Copilot]

Pull request overview

This PR mitigates accidental secret exposure in Porter/Terraform logs across Azure TRE templates by marking credential/parameter fields as sensitive, while bumping template versions and recording the change in the changelog.

Changes:

• Mark azure_client_secret (and where applicable auth_client_secret, client_secret, and airlock_request_sas_url) as sensitive: true in affected porter.yaml files.
• Increment template versions to reflect the change.
• Add a CHANGELOG entry referencing the fix.

Reviewed changes

Copilot reviewed 26 out of 26 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
templates/workspaces/unrestricted/porter.yaml	Mark workspace secrets as sensitive; bump template version.
templates/workspaces/base/porter.yaml	Mark workspace secrets as sensitive; bump template version.
templates/workspaces/airlock-import-review/porter.yaml	Mark workspace secrets as sensitive; bump template version.
templates/workspace_services/openai/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/ohdsi/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/mysql/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/health-services/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/gitea/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/databricks/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/azuresql/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/azureml/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/azureml/user_resources/aml_compute/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/guacamole/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/workspace_services/guacamole/user_resources/guacamole-azure-windowsvm/porter.yaml	Mark Azure/Auth client secrets as sensitive; bump version.
templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/porter.yaml	Mark Azure/Auth client secrets as sensitive; bump version.
templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm/porter.yaml	Mark Azure client secret and SAS URL parameter as sensitive; bump version.
templates/workspace_services/guacamole/user_resources/guacamole-azure-export-reviewvm/porter.yaml	Mark Azure client secret and SAS URL parameter as sensitive; bump version.
templates/shared_services/sonatype-nexus-vm/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/shared_services/gitea/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/shared_services/firewall/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/shared_services/databricks-auth/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/shared_services/cyclecloud/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/shared_services/certs/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/shared_services/airlock_notifier/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
templates/shared_services/admin-vm/porter.yaml	Mark Azure client secret credential as sensitive; bump version.
CHANGELOG.md	Document the security/logging fix under BUG FIXES.

[Copilot]

Pull request overview

Copilot reviewed 26 out of 26 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated no new comments.

[marrobi]

@JC-wk is this ready for review?

[JC-wk]

@JC-wk is this ready for review?

yes

[marrobi]

LGTM if it works.

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated no new comments.

[JC-wk]

@marrobi airlock_request_sas_url is the one that just needs a check/test since that is also now set in terraform

[marrobi]

@marrobi airlock_request_sas_url is the one that just needs a check/test since that is also now set in terraform

Will test.

[marrobi]

@JC-wk happy to merge, Opus did a small local check with some TF:

---

Tested the airlock_request_sas_url change specifically (the one flagged as also being set in Terraform). No live deployment — validated the Terraform sensitivity handling locally, since the concern was whether marking the variable sensitive breaks how the SAS URL is rendered into the review VM's bootstrap script.

What I checked:

terraform validate on the import-reviewvm root module and its vm submodule — both valid.

Sensitivity propagation — the SAS URL flows: var.airlock_request_sas_url (sensitive = true) → templatefile(download_review_data.ps1) → base64encode(join(compact([...]))) → VM custom_data. I replicated this exact pattern in a throwaway config and confirmed:

terraform apply succeeds with no "sensitive value" / invalid-context error.
The base64-decoded custom_data still contains the real SAS URL (incl. the sig= token). sensitive only masks it in plan/log output — it does not redact the value the VM actually needs to download the review data.
No leaks — neither review VM's outputs.tf exposes the SAS URL / review_data_script / custom_data.

Parity — porter sensitive: true matches Terraform sensitive = true for both import and export review VMs.

✅ Marking airlock_request_sas_url sensitive is safe — it validates, renders correctly, and the token still reaches the VM. Note this PR only added sensitive = true to the import reviewvm's variables.tf; the export one already had it, so both are now consistent.

I did not run a full end-to-end deploy (TRE + workspace + Guacamole + an in-review airlock import request provisioning an actual review VM). Happy to do that if we want live confirmation.

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated no new comments.