#32382 Leak of sensitive values if terraform debugging enabled and using azurerm remote backend

Terraform Version

Terraform v1.3.6
on linux_amd64

Terraform Configuration Files

variable "in" {
  type      = string
  default   = "prefix"
  sensitive = true
}

resource "random_pet" "this" {
  prefix = var.in
}

output "out" {
  value     = "sensitive-output"
  sensitive = false
}

output "out_sensitive" {
  value     = "sensitive-output-sensitive"
  sensitive = true
}

terraform {
  backend "azurerm" {
    
  }
}

Debug Output

....
2022-12-09T14:25:40.443Z [DEBUG] Azure Backend Response for https://*******.blob.core.windows.net/***: 
HTTP/1.1 200 OK
Content-Length: 997
Accept-Ranges: bytes
Content-Md5: ******
Content-Type: application/json
Date: Fri, 09 Dec 2022 14:25:36 GMT
Etag: "*****"
Last-Modified: Fri, 09 Dec 2022 14:25:32 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
X-Ms-Blob-Type: BlockBlob
X-Ms-Creation-Time: Fri, 09 Dec 2022 12:53:20 GMT
X-Ms-Lease-State: available
X-Ms-Lease-Status: unlocked
X-Ms-Request-Id: ******
X-Ms-Server-Encrypted: true
X-Ms-Version: 2018-11-09

{
  "version": 4,
  "terraform_version": "1.3.6",
  "serial": 1,
  "lineage": "124571b4-fb9b-d8f6-e7cf-ff01a11ef5a9",
  "outputs": {
    "out": {
      "value": "sensitive-output",
      "type": "string"
    },
    "out_sensitive": {
      "value": "sensitive-output-sensitive",
      "type": "string",
      "sensitive": true
    }
  },
  "resources": [
    {
      "mode": "managed",
      "type": "random_pet",
      "name": "this",
      "provider": "provider[\"registry.terraform.io/hashicorp/random\"]",
      "instances": [
        {
          "schema_version": 0,
          "attributes": {
            "id": "prefix-model-pig",
            "keepers": null,
            "length": 2,
            "prefix": "prefix",
            "separator": "-"
          },
          "sensitive_attributes": [
            [
              {
                "type": "get_attr",
                "value": "prefix"
              }
            ]
          ]
        }
      ]
    }
  ],
  "check_results": null
}
....

Notice that the whole content of tfstate is printed out including sensitive output sensitive-output-sensitive

Expected Behavior

Do not log the whole content of tfstate

Actual Behavior

Currently, if terraform debug mode is enabled (TF_LOG=debug|trace|json), and if I'm using a azurerm remote backend, secret might be revealed such as sensitive outputs.

Steps to Reproduce

terraform init (w/ azurerm remote backend)
TF_LOG=debug terraform apply But I think any operation which going to update the tfstate might print out tfstate content in plain text

Additional Context

Find below lines which are causing this behavior,

References

No response