provider/aws: Mark password fields as sensitive (#13147)

builtin/providers/aws/resource_aws_api_gateway_domain_name.go

@@ -48,6 +48,7 @@ func resourceAwsApiGatewayDomainName() *schema.Resource {
 				Type:          schema.TypeString,
 				ForceNew:      true,
 				Optional:      true,
+				Sensitive:     true,
 				ConflictsWith: []string{"certificate_arn"},
 			},
 

builtin/providers/aws/resource_aws_directory_service_directory.go

@@ -36,6 +36,7 @@ func resourceAwsDirectoryServiceDirectory() *schema.Resource {
 				Type:      schema.TypeString,
 				Required:  true,
 				ForceNew:  true,
+				Sensitive: true,
 			},
 			"size": &schema.Schema{
 				Type:     schema.TypeString,

builtin/providers/aws/resource_aws_kinesis_firehose_delivery_stream.go

@@ -152,6 +152,7 @@ func resourceAwsKinesisFirehoseDeliveryStream() *schema.Resource {
 						"password": {
 							Type:      schema.TypeString,
 							Required:  true,
+							Sensitive: true,
 						},
 
 						"role_arn": {

builtin/providers/aws/resource_aws_opsworks_application.go

@@ -104,6 +104,7 @@ func resourceAwsOpsworksApplication() *schema.Resource {
 						"password": {
 							Type:      schema.TypeString,
 							Optional:  true,
+							Sensitive: true,
 						},
 
 						"revision": {
@@ -189,6 +190,7 @@ func resourceAwsOpsworksApplication() *schema.Resource {
 						"private_key": {
 							Type:      schema.TypeString,
 							Required:  true,
+							Sensitive: true,
 							StateFunc: func(v interface{}) string {
 								switch v.(type) {
 								case string:

builtin/providers/aws/resource_aws_opsworks_stack.go

@@ -113,6 +113,7 @@ func resourceAwsOpsworksStack() *schema.Resource {
 						"password": {
 							Type:      schema.TypeString,
 							Optional:  true,
+							Sensitive: true,
 						},
 
 						"revision": {