Provider Credentials - Stored somewhere?

[HeikoMR]

Hello,

The credentials like username and password are passed to the postgresql-provider-block. Are they stored somewhere?
Let's say we read the database-credentials from AWS Secrets Manager or directly from the rds-database in an aws-provider data-block and pass them to the postgresql-provider-block, so that we can use terraform resources like installing postgresql-extensions on the target-database. What happen's with the credentials we passed to the provider-block? Since the password is neither hardcoded in cleartext anywhere in my terraform-code, nor in the state-file itself, is the password visible somewhere or is it safe to use?

Example of reading secrets manager value and passing it to the provider:

provider "postgresql" {
  host     = substr((jsondecode(data.aws_secretsmanager_secret_version.secret_version.secret_string)["host"]), 0, length(jsondecode(data.aws_secretsmanager_secret_version.secret_version.secret_string)["host"]) - 5)
  username = jsondecode(data.aws_secretsmanager_secret_version.secret_version.secret_string)["username"]
  password = jsondecode(data.aws_secretsmanager_secret_version.secret_version.secret_string)["password"]
}

Thanks in advance.
Heiko