This is a bummer. Yup. Will have to dig into this one.
At least, from the sounds of it, it’s reproducible. Just need create an example project that a KMS key and use the output helper. If you have an example, that’ll be appreciate. If not, no sweat.
RE: * I think there is few ways this can be solved and would like to gather feedback. Terraspace
output()helper function has configurable number of retries to attempt to get the value from state.
Sure.
RE: Terraspace has an option to fail a deploy if it detects a mock in the compiled terraform code.
Yup. It should fail hard.
So generally speaking, think:
- It should fail hard if a mock is somehow used
- The output should return null when values are not found instead if the string value with a warning message. Think that was a mistake. Related: Azure KeyVault Secrets and Azure Secrets · Issue #7 · boltops-tools/terraspace_plugin_azurerm · GitHub The person who created the issue does a good job of detailing the cases.
Hoping to get to it as part of this major version 
Unsure if will get to it though 
Happy to take a look PRs. Of course no sweat either way 