Is the AWS provider's web identity token (ProviderAssumeRoleWithWebIdentity#webIdentityToken) supposed to be marked as a secret? It's just a string at the moment; when we rotated this morning, the new token was displayed in the diff on our monitoring Slack channel. Which seems wrong...

Since accessKey, secretKey and token are marked as secret, I can see a case to also mark webIdentityToken as a secret. It is short-lived, which is at least something. I don't see harm in opening an issue to at least get this clarified. In the meantime you could mark it as a secret yourself or use webIdentityTokenFile

Is it possible to mark it as secret in an SDK-provided object like this? I'll give it a go.

I think so? e.g.

const provider = new aws.Provider("aws", {
  region: "us-east-1",
  assumeRoleWithWebIdentity: {
    roleArn,
    webIdentityToken: pulumi.secret(token),
  },
});

I can confirm it works. Though it did break my linting briefly..