Terraform - SHA256 hash of bytes that have been base64-encoded - hash

Question

Let's say that I have three null bytes, and I base64-encode them:
(Python)
import base64
import hashlib
foo = b'\xd3\x4d\x34'
foo_b64 = base64.b64encode(foo)
print(foo_b64)
# Outputs:
# 0000
foo_sha256 = hashlib.sha256(foo).hexdigest()
print(foo_sha256)
# Outputs:
# 0e10e03565f4664a05c3bc63ed35df3e1a9cb2568371db4f12b66c728943f802
Let's say I put that base64 string in a Terraform config:
locals {
foo_b64 = "0000"
}
In Terraform, I need to find a way to get the SHA256 hash of the raw value of foo, i.e. in Terraform I need to generate that same hash (0e10e03565f4664a05c3bc63ed35df3e1a9cb2568371db4f12b66c728943f802).
I've gone through the Terraform functions and can't seem to find something that works.
sha256(local.foo_b64) gives the SHA256 hash of the base64 string, not the raw bytes that it encodes.
sha256(base64decode(local.foo_b64)) throws an error: Call to function "base64decode" failed: the result of decoding the provided string is not valid UTF-8.
Is there any way to achieve this?

Answer 1

The Terraform language has a string type that is defined as containing Unicode characters rather than bytes, so anything which creates a string from raw input requires that input to be UTF-8 encoded Unicode characters.
This means that it isn't possible in general to pass raw binary data from one function to another. For situations where a Terraform configuration does need to work with small binary objects, the convention is to pass them around as base64 encoding, but that works only if your configuration treats the base64 data as opaque, never needing to decode it, because there is no way to represent the decoded form.
Given that, I think in order to solve your underlying problem with Terraform you will need to take a different approach. For example, perhaps whatever external system is generating the base64 string could also generate the SHA256 checksum of it, which Terraform would then also treat as opaque rather than trying to calculate it directly. You've presented one technical solution to an unstated problem here, so I can't be any more specific about what other options might be, but the main requirement would be that Terraform will just pass through the (base64-encoded) binary data verbatim to a provider and never interrogate it directly itself.