No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

:wave:
Im trying to use a terraform provider (<https://registry.terraform.io/providers/ClickHouse/clickhousedbops/latest/docs>) - I added it like I have many others `pulumi package add terraform-provider .....`  and im getting this error
```pulumi:providers:clickhousedbops resource 'default_1_3_1' has a problem: could not validate provider configuration: Invalid Attribute Value Length. Attribute auth_config.password string length must be at least 1, got: 0. Check `pulumi config get --path clickhousedbops:authConfig.password`.```
of course, i do the CLI command and it is indeed blank - because in pulumi cloud ESC i set it as a secret, cause it is a password.

I have a feeling it's because the provider didn't mark the field as sensitive, but is there any way to make it work without having to modify the source?

This is where i think the provider should add the "sensitive: true"
<https://github.com/ClickHouse/terraform-provider-clickhousedbops/blob/main/pkg/provider/provider.go#L91>

can you test opening in manually and seeing if youre password resolves correctly?

image.png

Yeah, when I look at it in esc it shows correctly, and when i do
```pulumi config get --path clickhousedbops:authConfig.password```
i get back an empty line
vs
```pulumi config get --path clickhousedbops:authConfig.password123```
(which doesnt exist)
i get an error `configuration key 'clickhousedbops:authConfig.password123' not found for stack`

so its def there and at that path... its just a secret

When i do
```pulumi config get --path clickhousedbops:authConfig.strategy```
i properly get back "password"

have you tested with it set manually in your stack config?

I have not, i can try that in a little bit though

I looked into this and am not able to reproduce. I tried to create an ESC environment similar to yours and when I run `pulumi config get --path clickhousedbops:authConfig.password` I get the secret as expected. have you confirmed that you are able to view the plaintext secret from esc?

oh this is so weird, now im not able to see it!

i re-entered it and will try again with the provider

ok its no longer empty when i do `pulumi config get --path clickhousedbops:authConfig.password`