Values

formae.value() wraps a regular value so you can attach extra behavior to it. Two modifiers are available: .opaque for secrets and .setOnce for values that should stay stable across applies.

Opaque values

.opaque marks a value as a secret that is never displayed to the user. Opaque values can still be referenced through .res and passed between resources, but they’re never shown in logs, output, or CLI results. Use it for passwords, API keys, and other sensitive fields.

local dbSecret = new secret.Secret {
  label = "db-password"
  secretString = formae.value("my-secret-password").opaque
}
dbSecret

Other resources can still reference the value through .res:

new dbinstance.DBInstance {
  label = "my-database"
  masterUserPassword = dbSecret.res.secretString  // References the opaque value
}

setOnce

.setOnce generates or captures a value the first time it’s applied, then keeps it constant on every later apply, even if the expression that produced it would otherwise evaluate to something different. This matters for anything generated randomly: without .setOnce, a random password would get a new value on every apply.

local dbSecret = new secret.Secret {
  label = "db-password"
  secretString = formae.value(random.id(16).toString()).setOnce
}
dbSecret

random.id(16).toString() generates a random 16-character identifier; .setOnce ensures the same value is reused on every subsequent apply of this forma.

Combining opaque and setOnce

The two modifiers chain, which is the common case for generated secrets: stable across applies and never shown.

apiKey = formae.value(random.id(32).toString()).opaque.setOnce

This produces a secret API key that is generated once, never displayed, and never changes.

Get started

Guides

Concepts

Reference

Opaque values

setOnce

Combining opaque and setOnce

See also

​Opaque values

​setOnce

​Combining opaque and setOnce

​See also

Opaque values

setOnce

Combining opaque and setOnce

See also