This message was deleted.

And, as usual, as soon as I post a question, I see the answer.

additionalSecretOutputs

is an option, not a property 🙂

Note that you may also want to use

RandomPassword

instead. It is the same as random string, but doesn’t expose the generated string in the id.