I am afraid I am using

additionalSecretOutputs

incorrectly, although I could have sworn this used to work:

let pw = new random.RandomString("test-password", {
    length: 8,
    special: false,
    additionalSecretOutputs: ["result", "id"]
});

let param = new aws.ssm.Parameter("test-password", {
    length: 8,
    value: pw.result,
    type: "SecureString"
});

Expectation: The value of the RandomString and SSM parameter are not visible in plaintext in the stack state and web console. Actual: The plaintext is visible in the stack state and web console.

Note that you may also want to use

RandomPassword

instead. It is the same as random string, but doesn’t expose the generated string in the id.