diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9f9733a..1d73889 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -71,4 +71,10 @@
 
 * 2.8.3 -- 2022-09-14
   - fix access key variables and usage
+<<<<<<< HEAD
   - add secret
+=======
+
+* 2.8.4 -- 2023-11-22
+  - if pgp_key_file is not provided (empty), it will use the secret vs encrypted secret, so that the secret can be used as input into other resources
+>>>>>>> 045eb41f1a92a7a1d4485246e132fe15d4e2e95d
diff --git a/README.md b/README.md
index beea888..4cd6901 100644
--- a/README.md
+++ b/README.md
@@ -71,6 +71,18 @@ git push
 
 The `variables.auto.tfvars` is there to enable this directory to be used for key rotation with the `rotate-keys.py` script.
 
+## Changes when running plan or apply
+You may see a `tf-plan` and a `tf-apply` inform you of changes to two different resources in a directory where you have used
+this access key enablement:
+
+*   module.NAME.local\_sensitive\_file.access\_key\_file[0]
+*   module.NAME.null\_resource.access\_key\_file\_decrypt\_key[0]
+
+This is because these resources are populated from `data` sources with a `templatefile()`.  As such, it does not know
+the output of the template until run time, so it re-generates that data.  If there are no changes to the key, it will simple
+create these files with the same content as before. This is not harmful, but it is important to understand when you see changes
+in a plan you know you didn't make.
+
 ## Requirements
 
 No requirements.
@@ -141,7 +153,7 @@ No requirements.
 | Name | Description |
 |------|-------------|
 | <a name="output_aws_access_key_id"></a> [aws\_access\_key\_id](#output\_aws\_access\_key\_id) | AWS Access Key (current) |
-| <a name="output_aws_secret_access_key"></a> [aws\_secret\_access\_key](#output\_aws\_secret\_access\_key) | AWS Secret Access Key [encrypted] (current) |
+| <a name="output_aws_secret_access_key"></a> [aws\_secret\_access\_key](#output\_aws\_secret\_access\_key) | AWS Secret Access Key, either encrypted (if using PGP key) or clear |
 | <a name="output_user_arn"></a> [user\_arn](#output\_user\_arn) | User ARN |
 | <a name="output_user_name"></a> [user\_name](#output\_user\_name) | User name |
 | <a name="output_user_password"></a> [user\_password](#output\_user\_password) | User Password |
diff --git a/access_keys.tf b/access_keys.tf
index e9467fa..2cd889f 100644
--- a/access_keys.tf
+++ b/access_keys.tf
@@ -85,7 +85,7 @@ resource "local_sensitive_file" "access_key_file" {
 }
 
 resource "null_resource" "access_key_file_decrypt_key" {
-  count = var.create_access_keys ? 1 : 0
+  count = var.create_access_keys && var.pgp_key_file != "" ? 1 : 0
   triggers = {
     access_keys_directory = var.create_access_keys ? format("%v/%v", path.root, join("", null_resource.rotate_keys_tfvars.*.triggers.access_keys_directory)) : "."
     access_key_file       = var.create_access_keys ? join("", local_sensitive_file.access_key_file.*.filename) : "empty.txt"
diff --git a/main.tf b/main.tf
index b306ac5..1a5ea6f 100644
--- a/main.tf
+++ b/main.tf
@@ -71,6 +71,18 @@
 * ```
 *
 * The `variables.auto.tfvars` is there to enable this directory to be used for key rotation with the `rotate-keys.py` script.
+*
+* ## Changes when running plan or apply
+* You may see a `tf-plan` and a `tf-apply` inform you of changes to two different resources in a directory where you have used
+* this access key enablement:
+*
+* *   module.NAME.local_sensitive_file.access_key_file[0]
+* *   module.NAME.null_resource.access_key_file_decrypt_key[0]
+*
+* This is because these resources are populated from `data` sources with a `templatefile()`.  As such, it does not know
+* the output of the template until run time, so it re-generates that data.  If there are no changes to the key, it will simple
+* create these files with the same content as before. This is not harmful, but it is important to understand when you see changes
+* in a plan you know you didn't make.
 */
 
 locals {
diff --git a/outputs.access_keys.tf b/outputs.access_keys.tf
index fa78f62..637effa 100644
--- a/outputs.access_keys.tf
+++ b/outputs.access_keys.tf
@@ -15,7 +15,7 @@ output "aws_access_key_id" {
 }
 
 output "aws_secret_access_key" {
-  description = "AWS Secret Access Key [encrypted] (current)"
+  description = "AWS Secret Access Key, either encrypted (if using PGP key) or clear"
   #  value       = join("", aws_iam_access_key.iam_access_key_v1.*.encrypted_secret)
-  value = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "encrypted_secret", "") : ""
+  value = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "encrypted_secret", "") : lookup(aws_iam_access_key.iam_access_key_v1[0], "secret", "")
 }
diff --git a/version.tf b/version.tf
index c6b1ea7..1a3865e 100644
--- a/version.tf
+++ b/version.tf
@@ -1,4 +1,4 @@
 locals {
   _module_name    = "aws-iam-user"
-  _module_version = "2.8.3"
+  _module_version = "2.8.4"
 }