Terraform vSphere Provider v2.17.1: Sensitive Product Key Fix and Dependency Updates

Introduction

HashiCorp (vmware/terraform-provider-vsphere) released v2.17.1 of the Terraform vSphere provider on 2026-09-14. This is a small maintenance release with one bug fix, a documentation link update, and two chore-level dependency bumps. No new resources, data sources, or breaking changes are included. This article covers what matters for teams running vSphere infrastructure with Terraform.

What Is New

Bug Fix: product_key marked as sensitive

The vsphere_guest_os_customization data source now flags the product_key attribute as sensitive (#2767). Previously, this value could appear in plain text in terraform plan/terraform apply output and in state file diffs shown on screen. After upgrading, Terraform will redact it automatically:

data "vsphere_guest_os_customization" "windows_spec" {
  name = "windows-customization-spec"
}
 
# product_key is now shown as (sensitive value) in plan/apply output
output "customization_product_key" {
  value = data.vsphere_guest_os_customization.windows_spec.product_key
  # Terraform will require sensitive = true to display it explicitly
}

If you reference product_key in an output block without sensitive = true, Terraform will now error and require you to mark the output sensitive as well:

output "customization_product_key" {
  value     = data.vsphere_guest_os_customization.windows_spec.product_key
  sensitive = true
}

Check any pipelines or scripts that previously scraped this value from CLI output or logs, since it will no longer be printed in plain text.

Documentation

The Terraform import documentation link ([docs-import]) was updated to point directly to the product documentation URL instead of an older reference (#2769). No action required; this is a docs-only change.

Chore / Dependency bumps

• google.golang.org/grpc bumped from v1.82.1 to v1.83.2 (#2766).
• Build toolchain go bumped from 1.26.7 to 1.26.8 (#2768).

These are internal build dependency updates with no HCL-facing impact, included here for completeness and supply-chain visibility.

Upgrade Steps

Pin the provider version and run a standard upgrade:

terraform {
  required_providers {
    vsphere = {
      source  = "hashicorp/vsphere"
      version = "2.17.1"
    }
  }
}

terraform init -upgrade

Since there is no previously known version pinned in this environment, this is effectively an initial adoption of the 2.17.1 release line. If you already track the vsphere provider with a flexible constraint (e.g. ~> 2.17), simply re-run terraform init -upgrade to pick up the patch.

Verify

Confirm the provider version in use:

terraform providers

Run a plan against configuration that uses vsphere_guest_os_customization and confirm product_key is redacted in the CLI output:

terraform plan

Expected output for the attribute should show (sensitive value) rather than the literal key string. If any output block referencing product_key was not previously marked sensitive, terraform plan or terraform apply will fail with an error until sensitive = true is added.

Conclusion

v2.17.1 is a low-risk patch release focused on a security-relevant fix (sensitive handling of product_key), a documentation link correction, and routine dependency bumps. The release notes are otherwise thin — no new resources, data sources, or deprecations are listed. Teams managing Windows guest customization specs should upgrade promptly and check for any outputs or external tooling that depend on reading product_key in plain text. For the full changelog, see the release page.