Values

Values in formae provide special processing for regular values when you need additional behaviors. The formae.value() function wraps a value and enables two key features: .opaque for secrets and .setOnce for immutable values.

Opaque Values

The .opaque modifier marks a value as a secret that should never be displayed to the user. Opaque values can be used in res, stored in cloud provider secret management services, and passed between resources securely. Think of passwords, API keys, and other sensitive fields.

Example:

local dbSecret = new secret.Secret {
  label = "db-password"
  secretString = formae.value("my-secret-password").opaque
}
dbSecret

Once defined as opaque, this value can be referenced through .res, but it will never be displayed in logs, output, or CLI results:

new dbinstance.DBInstance {
  label = "my-database"
  masterUserPassword = dbSecret.res.secretString  // References the opaque value
}

setOnce

The .setOnce modifier ensures a value is set only once—the first time it's created or used. After that, the value remains constant even if the formula or source changes. This is especially helpful for randomly generated passwords and keys that should remain stable across applies.

Example:

local dbSecret = new secret.Secret {
  label = "db-password"
  secretString = formae.value(random.id(16).toString()).setOnce
}
dbSecret

In this example: - random.id(16).toString() generates a random 16-character identifier - .setOnce ensures the same value is used every time, even if you reapply the forma

Combining opaque and setOnce:

These modifiers work together perfectly for secrets that need to be both secure and stable:

apiKey = formae.value(random.id(32).toString()).opaque.setOnce

This creates a secret API key that is generated once, never displayed, and never changes.