feat(secretsmanager): remove RedactSensitive branch; raise minFormaeVersion to 0.89.0

The RedactSensitive field has been removed from the formae plugin SDK (ReadRequest
and ReadResource structs). The field was the only mechanism suppressing secret
enrichment during discovery reads; secrets are now hashed at rest and resolved
in-flight, making the suppression unnecessary.

Secret.Read now unconditionally calls GetSecretValue — the enrichment path that
was already taken for non-discovery reads. The pre-Read version gate in the formae
agent (FilterCompatiblePlugins) ensures an old agent cannot load this plugin: a
plugin declaring minFormaeVersion=0.89.0 is rejected at startup by any agent
running an older version, so no Read reaches an agent that does not know to hash
the secret value.

minFormaeVersion is raised to 0.89.0 — the formae release that ships the SDK
removal (assumption: confirm this matches the actual release version at release
time; this plugin must not be released until the corresponding formae release
is published).

The Read implementation is refactored to accept injectable ccxReader and
secretValueGetter interfaces, enabling the new unit tests to exercise the
enrichment path without live AWS credentials.

Author: JeroenSoeters

formae-plugin.pkl

@@ -11,7 +11,7 @@ summary = "AWS resource plugin (CloudControl-based)"
 description = "AWS CloudControl resource plugin for Formae"
 category = "cloud"
 license = "FSL-1.1-ALv2"
-minFormaeVersion = "0.88.0"
+minFormaeVersion = "0.89.0"
 
 output {
   renderer = new JsonRenderer {}

pkg/cfres/secretsmanager/secret.go

@@ -20,6 +20,16 @@ import (
 	"github.com/platform-engineering-labs/formae-plugin-aws/pkg/config"
 )
 
+// ccxReader is the subset of ccx.Client used by Secret.Read.
+type ccxReader interface {
+	ReadResource(ctx context.Context, request *resource.ReadRequest) (*resource.ReadResult, error)
+}
+
+// secretValueGetter is the subset of secretsmanager.Client used by Secret.Read.
+type secretValueGetter interface {
+	GetSecretValue(ctx context.Context, params *secretsmanager.GetSecretValueInput, optFns ...func(*secretsmanager.Options)) (*secretsmanager.GetSecretValueOutput, error)
+}
+
 type Secret struct {
 	cfg *config.Config
 }
@@ -39,34 +49,32 @@ func init() {
 		})
 }
 
-// Read enhances Cloud Control read with actual secret value
+// Read enhances Cloud Control read with actual secret value.
 func (s *Secret) Read(ctx context.Context, request *resource.ReadRequest) (*resource.ReadResult, error) {
 	ccxClient, err := ccx.NewClient(s.cfg)
 	if err != nil {
 		plugin.LoggerFromContext(ctx).Error("SecretsManager: Failed to create ccx client", "error", err)
 		return nil, err
 	}
 
-	result, err := ccxClient.ReadResource(ctx, request)
+	awsCfg, err := s.cfg.ToAwsConfig(ctx)
 	if err != nil {
-		plugin.LoggerFromContext(ctx).Error("SecretsManager: Cloud Control ReadResource failed", "error", err)
+		plugin.LoggerFromContext(ctx).Error("SecretsManager: Failed to create AWS config", "error", err)
 		return nil, err
 	}
 
-	// Don't bother enriching with secret value when RedactSensitive is set
-	if request.RedactSensitive {
-		return result, nil
-	}
+	return s.readWithClients(ctx, ccxClient, secretsmanager.NewFromConfig(awsCfg), request)
+}
 
-	awsCfg, err := s.cfg.ToAwsConfig(ctx)
+// readWithClients performs the enriched read using injectable clients (enables unit testing).
+func (s *Secret) readWithClients(ctx context.Context, ccxClient ccxReader, smClient secretValueGetter, request *resource.ReadRequest) (*resource.ReadResult, error) {
+	result, err := ccxClient.ReadResource(ctx, request)
 	if err != nil {
-		plugin.LoggerFromContext(ctx).Error("SecretsManager: Failed to create AWS config", "error", err)
+		plugin.LoggerFromContext(ctx).Error("SecretsManager: Cloud Control ReadResource failed", "error", err)
 		return nil, err
 	}
 
-	secretsClient := secretsmanager.NewFromConfig(awsCfg)
-
-	secret, err := secretsClient.GetSecretValue(ctx, &secretsmanager.GetSecretValueInput{
+	secret, err := smClient.GetSecretValue(ctx, &secretsmanager.GetSecretValueInput{
 		SecretId: &request.NativeID,
 	})
 	if err != nil {

pkg/cfres/secretsmanager/secret_test.go

@@ -0,0 +1,145 @@
+// © 2025 Platform Engineering Labs Inc.
+//
+// SPDX-License-Identifier: FSL-1.1-ALv2
+
+//go:build unit
+
+package secretsmanager
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/secretsmanager"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+
+	"github.com/platform-engineering-labs/formae/pkg/plugin/resource"
+	"github.com/platform-engineering-labs/formae-plugin-aws/pkg/config"
+)
+
+// mockCCXReader mocks the Cloud Control read path.
+type mockCCXReader struct {
+	mock.Mock
+}
+
+func (m *mockCCXReader) ReadResource(ctx context.Context, req *resource.ReadRequest) (*resource.ReadResult, error) {
+	args := m.Called(ctx, req)
+	if args.Get(0) == nil {
+		return nil, args.Error(1)
+	}
+	return args.Get(0).(*resource.ReadResult), args.Error(1)
+}
+
+// mockSMClient mocks the SecretsManager GetSecretValue call.
+type mockSMClient struct {
+	mock.Mock
+}
+
+func (m *mockSMClient) GetSecretValue(ctx context.Context, input *secretsmanager.GetSecretValueInput, optFns ...func(*secretsmanager.Options)) (*secretsmanager.GetSecretValueOutput, error) {
+	args := m.Called(ctx, input)
+	if args.Get(0) == nil {
+		return nil, args.Error(1)
+	}
+	return args.Get(0).(*secretsmanager.GetSecretValueOutput), args.Error(1)
+}
+
+func TestSecret_Read_AlwaysEnrichesSecretValue(t *testing.T) {
+	// Read unconditionally enriches: the secret value is always fetched and
+	// merged into the result properties.
+	ctx := context.Background()
+	ccxMock := &mockCCXReader{}
+	smMock := &mockSMClient{}
+
+	ccxMock.On("ReadResource", ctx, mock.Anything).Return(&resource.ReadResult{
+		ResourceType: "AWS::SecretsManager::Secret",
+		Properties:   `{"Name":"my-secret","ARN":"arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"}`,
+	}, nil)
+
+	secretVal := "super-secret-value"
+	smMock.On("GetSecretValue", ctx, mock.MatchedBy(func(in *secretsmanager.GetSecretValueInput) bool {
+		return in.SecretId != nil && *in.SecretId == "my-secret-id"
+	})).Return(&secretsmanager.GetSecretValueOutput{
+		SecretString: aws.String(secretVal),
+	}, nil)
+
+	s := &Secret{cfg: &config.Config{}}
+	result, err := s.readWithClients(ctx, ccxMock, smMock, &resource.ReadRequest{
+		NativeID:     "my-secret-id",
+		ResourceType: "AWS::SecretsManager::Secret",
+	})
+
+	require.NoError(t, err)
+	require.NotNil(t, result)
+
+	var props map[string]any
+	require.NoError(t, json.Unmarshal([]byte(result.Properties), &props))
+	assert.Equal(t, secretVal, props["SecretString"], "SecretString must be present in result")
+
+	ccxMock.AssertExpectations(t)
+	smMock.AssertExpectations(t)
+}
+
+func TestSecret_Read_EnrichesEvenWhenCCXReturnsEmptyProperties(t *testing.T) {
+	// Enrichment works even when Cloud Control returns an empty properties blob.
+	ctx := context.Background()
+	ccxMock := &mockCCXReader{}
+	smMock := &mockSMClient{}
+
+	ccxMock.On("ReadResource", ctx, mock.Anything).Return(&resource.ReadResult{
+		ResourceType: "AWS::SecretsManager::Secret",
+		Properties:   "",
+	}, nil)
+
+	secretVal := "another-secret"
+	smMock.On("GetSecretValue", ctx, mock.Anything).Return(&secretsmanager.GetSecretValueOutput{
+		SecretString: aws.String(secretVal),
+	}, nil)
+
+	s := &Secret{cfg: &config.Config{}}
+	result, err := s.readWithClients(ctx, ccxMock, smMock, &resource.ReadRequest{
+		NativeID:     "my-secret-id",
+		ResourceType: "AWS::SecretsManager::Secret",
+	})
+
+	require.NoError(t, err)
+	var props map[string]any
+	require.NoError(t, json.Unmarshal([]byte(result.Properties), &props))
+	assert.Equal(t, secretVal, props["SecretString"])
+}
+
+func TestSecret_Read_GetSecretValueFailureReturnsPartialResult(t *testing.T) {
+	// If GetSecretValue fails, Read still returns the Cloud Control result
+	// (no secret enrichment) rather than propagating an error.
+	ctx := context.Background()
+	ccxMock := &mockCCXReader{}
+	smMock := &mockSMClient{}
+
+	ccxMock.On("ReadResource", ctx, mock.Anything).Return(&resource.ReadResult{
+		ResourceType: "AWS::SecretsManager::Secret",
+		Properties:   `{"Name":"my-secret"}`,
+	}, nil)
+
+	smMock.On("GetSecretValue", ctx, mock.Anything).Return(
+		(*secretsmanager.GetSecretValueOutput)(nil),
+		errors.New("access denied"),
+	)
+
+	s := &Secret{cfg: &config.Config{}}
+	result, err := s.readWithClients(ctx, ccxMock, smMock, &resource.ReadRequest{
+		NativeID:     "my-secret-id",
+		ResourceType: "AWS::SecretsManager::Secret",
+	})
+
+	require.NoError(t, err, "GetSecretValue failure must not propagate as an error")
+	require.NotNil(t, result)
+
+	var props map[string]any
+	require.NoError(t, json.Unmarshal([]byte(result.Properties), &props))
+	_, hasSecret := props["SecretString"]
+	assert.False(t, hasSecret, "SecretString must be absent when GetSecretValue fails")
+}