diff --git a/enos/modules/aws_rdp_domain_controller/main.tf b/enos/modules/aws_rdp_domain_controller/main.tf
index a38279aa65..785fca079e 100644
--- a/enos/modules/aws_rdp_domain_controller/main.tf
+++ b/enos/modules/aws_rdp_domain_controller/main.tf
@@ -439,10 +439,6 @@ resource "aws_instance" "domain_controller" {
   }
 }
 
-locals {
-  password = rsadecrypt(aws_instance.domain_controller.password_data, tls_private_key.rsa_4096_key.private_key_pem)
-}
-
 resource "local_sensitive_file" "private_key" {
   depends_on = [tls_private_key.rsa_4096_key]
 
diff --git a/enos/modules/aws_rdp_domain_controller/outputs.tf b/enos/modules/aws_rdp_domain_controller/outputs.tf
index 815150c8bd..c2e206e6c2 100644
--- a/enos/modules/aws_rdp_domain_controller/outputs.tf
+++ b/enos/modules/aws_rdp_domain_controller/outputs.tf
@@ -24,7 +24,8 @@ output "admin_username" {
 
 output "password" {
   description = "This is the decrypted administrator password for the EC2 instance"
-  value       = nonsensitive(local.password)
+  value = nonsensitive(rsadecrypt(aws_instance.domain_controller.password_data, tls_private_key.rsa_4096_key.private_key_pem))
+
 }
 
 output "ssh_private_key" {
diff --git a/enos/modules/aws_rdp_member_server/main.tf b/enos/modules/aws_rdp_member_server/main.tf
index 41ed16844e..8411fefc51 100644
--- a/enos/modules/aws_rdp_member_server/main.tf
+++ b/enos/modules/aws_rdp_member_server/main.tf
@@ -245,7 +245,6 @@ ${var.domain_admin_password}
 }
 
 locals {
-  password    = rsadecrypt(aws_instance.member_server.password_data, file(var.domain_controller_private_key))
   private_key = abspath(var.domain_controller_private_key)
 }
 
diff --git a/enos/modules/aws_rdp_member_server/outputs.tf b/enos/modules/aws_rdp_member_server/outputs.tf
index 50e1247d03..bf6bc1eed4 100644
--- a/enos/modules/aws_rdp_member_server/outputs.tf
+++ b/enos/modules/aws_rdp_member_server/outputs.tf
@@ -25,7 +25,8 @@ output "admin_username" {
 
 output "password" {
   description = "This is the decrypted administrator password for the EC2 instance"
-  value       = local.password
+  value = nonsensitive(rsadecrypt(aws_instance.member_server.password_data, file(var.domain_controller_private_key)))
+
 }
 
 output "domain_hostname" {
diff --git a/enos/modules/aws_rdp_member_server_with_worker/main.tf b/enos/modules/aws_rdp_member_server_with_worker/main.tf
index 4fc906c74a..f156c33bae 100644
--- a/enos/modules/aws_rdp_member_server_with_worker/main.tf
+++ b/enos/modules/aws_rdp_member_server_with_worker/main.tf
@@ -262,7 +262,6 @@ ${var.domain_admin_password}
 }
 
 locals {
-  admin_password        = rsadecrypt(aws_instance.worker.password_data, file(var.domain_controller_private_key))
   private_key           = abspath(var.domain_controller_private_key)
   boundary_cli_zip_path = var.boundary_cli_zip_path != "" ? abspath(var.boundary_cli_zip_path) : ""
   test_dir              = "C:/Test/" # needs to end in a / to ensure it creates the directory
diff --git a/enos/modules/aws_rdp_member_server_with_worker/outputs.tf b/enos/modules/aws_rdp_member_server_with_worker/outputs.tf
index 12281dcb64..b696be4e6b 100644
--- a/enos/modules/aws_rdp_member_server_with_worker/outputs.tf
+++ b/enos/modules/aws_rdp_member_server_with_worker/outputs.tf
@@ -26,5 +26,5 @@ output "admin_username" {
 // This is the decrypted administrator password for the EC2 instance
 output "admin_password" {
   description = "Decrpted admin password for the EC2 instance"
-  value       = nonsensitive(local.admin_password)
+  value       = nonsensitive(rsadecrypt(aws_instance.worker.password_data, file(var.domain_controller_private_key)))
 }
\ No newline at end of file
diff --git a/enos/modules/aws_windows_client/outputs.tf b/enos/modules/aws_windows_client/outputs.tf
index 5577e639e5..2e9c0bdc4a 100644
--- a/enos/modules/aws_windows_client/outputs.tf
+++ b/enos/modules/aws_windows_client/outputs.tf
@@ -35,7 +35,7 @@ output "test_username" {
 }
 output "test_password" {
   description = "The password of the test account"
-  value       = nonsensitive(local.test_password)
+  value       = nonsensitive(rsadecrypt(aws_instance.client.password_data, tls_private_key.rsa-4096-key.private_key_pem))
 }
 
 output "test_dir" {