IssueTracker

Issue summary: A customer is using Deployment Manager and in the deployment he encrypts the service accounts keys that it creates using the function encrypt which encrypt a plaintext using a key. The issue is that after deploying the manifest shows the plaintext used in the action to encrypt. Customer would like to have the output the service key KMS encrypted value, without storing the plaintext in the deployment manager's manifest.

Log/Graph data:   N/A

Example:
 - name: encrypt
  action: gcp-types/cloudkms-v1:cloudkms.projects.locations.keyRings.cryptoKeys.encrypt
  properties:
    name: $(ref.cryptoKey.name)
    # Base64 encoded plain text string
    plaintext: $(ref.listLocations.toString().base64Encode())

GCloud output or API error: After deploying the plaintext field appears with the clear text in the manifest.