func GetSensitiveObservation(ctx context.Context, client SecretClient, from *v1.SecretReference, into map[string]interface{}) error {
	if from == nil {
		return nil
	}
	conn, err := client.GetSecretData(ctx, from)
	if kerrors.IsNotFound(err) {
		return nil
	}
	if err != nil {
		return errors.Wrapf(err, "cannot get connection secret")
	}
	paveTF := fieldpath.Pave(into)
	for k, v := range conn {
		if !strings.HasPrefix(k, prefixAttribute) {
			continue
		}
		fp, err := secretKeyToFieldPath(strings.TrimPrefix(k, prefixAttribute))
		if err != nil {
			return errors.Wrapf(err, "cannot convert secret key %q to fieldpath", k)
		}
		if err = paveTF.SetString(fp, string(v)); err != nil {
			return errors.Wrapf(err, "cannot set sensitive string in tf attributes for fieldpath %q", fp)
		}
	}
	return nil
}
GetSensitiveObservation will return sensitive information as terraform state
attributes by reading them from connection details.
package resource
import (
	"context"
	"fmt"
	"regexp"
	"strings"
	v1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
	"github.com/crossplane/crossplane-runtime/pkg/fieldpath"
	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
	"github.com/pkg/errors"
	kerrors "k8s.io/apimachinery/pkg/api/errors"
	"k8s.io/apimachinery/pkg/runtime"
	"github.com/crossplane-contrib/terrajet/pkg/config"
)
const (
	errCannotExpandWildcards          = "cannot expand wildcards"
	errFmtCannotGetStringForFieldPath = "cannot not get a string for fieldpath %q"
)
const (
	prefixAttribute = "attribute."
)
var reEndsWithIndex *regexp.Regexp
var reMiddleIndex *regexp.Regexp
var reInsideThreeDotsBlock *regexp.Regexp
func init() {
	reEndsWithIndex = regexp.MustCompile(`\.(\d+?)$`)
	reMiddleIndex = regexp.MustCompile(`\.(\d+?)\.`)
	reInsideThreeDotsBlock = regexp.MustCompile(`\.\.\.(.*?)\.\.\.`)
}
type SecretClient interface {
	GetSecretData(ctx context.Context, ref *v1.SecretReference) (map[string][]byte, error)
	GetSecretValue(ctx context.Context, sel v1.SecretKeySelector) ([]byte, error)
}
func GetConnectionDetails(attr map[string]interface{}, tr Terraformed, cfg config.Resource) (managed.ConnectionDetails, error) {
	conn, err := GetSensitiveAttributes(attr, tr.GetConnectionDetailsMapping(), tr.GetTerraformResourceIDField())
	if err != nil {
		return nil, errors.Wrap(err, "cannot get connection details")
	}
	var custom map[string][]byte
	if cfg.Sensitive.AdditionalConnectionDetailsFn != nil {
		if custom, err = cfg.Sensitive.AdditionalConnectionDetailsFn(attr); err != nil {
			return nil, errors.Wrap(err, "cannot get custom connection keys")
		}
	}
	if conn == nil {
		return custom, nil
	}
	for k, v := range custom {
		if _, ok := conn[k]; ok {
			return nil, errors.Errorf("custom connection keys cannot start with %q, overriding reserved connection key (%q) is not allowed", k, prefixAttribute)
		}
		conn[k] = v
	}
	return conn, nil
}
func GetSensitiveAttributes(from map[string]interface{}, mapping map[string]string, idField string) (map[string][]byte, error) {
	if len(mapping) == 0 {
		return nil, nil
	}
	vals := make(map[string][]byte)
	for tf := range mapping {
		paved := fieldpath.Pave(from)
		fieldPaths, err := paved.ExpandWildcards(tf)
		if err != nil {
			return nil, errors.Wrap(err, errCannotExpandWildcards)
		}
		for _, fp := range fieldPaths {
			v, err := paved.GetString(fp)
			if err != nil {
				return nil, errors.Wrapf(err, errFmtCannotGetStringForFieldPath, fp)
			}
			k, err := fieldPathToSecretKey(fp)
			if err != nil {
				return nil, errors.Wrapf(err, "cannot convert fieldpath %q to secret key", fp)
			}
			vals[fmt.Sprintf("%s%s", prefixAttribute, k)] = []byte(v)
		}
	}
	id, ok := from[idField].(string)
	if ok {
		vals[fmt.Sprintf("%s%s", prefixAttribute, idField)] = []byte(id)
	}
	return vals, nil
}
func GetSensitiveParameters(ctx context.Context, client SecretClient, from runtime.Object, into map[string]interface{}, mapping map[string]string) error {  
	if len(mapping) == 0 {
		return nil
	}
	pavedJSON, err := fieldpath.PaveObject(from)
	if err != nil {
		return err
	}
	pavedTF := fieldpath.Pave(into)
	var sensitive []byte
	for tfPath, jsonPath := range mapping {
		jsonPathSet, err := pavedJSON.ExpandWildcards(jsonPath)
		if err != nil {
			return errors.Wrapf(err, "cannot expand wildcard for xp resource")
		}
		for _, expandedJSONPath := range jsonPathSet {
			sel := &v1.SecretKeySelector{}
			if err = pavedJSON.GetValueInto(expandedJSONPath, sel); err != nil {
				return errors.Wrapf(err, "cannot get SecretKeySelector from xp resource for fieldpath %q", expandedJSONPath)
			}
			sensitive, err = client.GetSecretValue(ctx, *sel)
			if err != nil {
				return errors.Wrapf(err, "cannot get secret value for %v", sel)
			}
			expTF, err := expandedTFPath(expandedJSONPath, mapping)
			if err != nil {
				return err
			}
			if err = pavedTF.SetString(expTF, string(sensitive)); err != nil {
				return errors.Wrapf(err, "cannot set string as terraform attribute for fieldpath %q", tfPath)
			}
		}
	}
	return nil
}