dont spit out stdout and stderr for execute resource failure, if its declared sensitive

1 files changed, 10 insertions, 1 deletions

diff --git a/lib/chef/provider/execute.rb b/lib/chef/provider/execute.rb
index c3dd3b4ee1..67e5bfa842 100644
--- a/lib/chef/provider/execute.rb
+++ b/lib/chef/provider/execute.rb
@@ -58,7 +58,16 @@ class Chef
         end
 
         converge_by("execute #{description}") do
-          result = shell_out!(command, opts)
+          begin
+            shell_out!(command, opts)
+          rescue Mixlib::ShellOut::ShellCommandFailed => e
+            if sensitive?
+              raise Mixlib::ShellOut::ShellCommandFailed,
+                "Command execution failed. STDOUT/STDERR suppressed for sensitive resource"
+            else
+              raise e
+            end
+          end
           Chef::Log.info("#{new_resource} ran successfully")
         end
       end