Adopting Terraform Ephemeral Resources

Short summary

Terraform 1.11 introduced ephemeral resources and write-only attributes to keep secrets out of the statefile. This tutorial walks through four adoption scenarios: replacing data sources that fetch static secrets, passing secrets via ephemeral variables, handling dynamically generated secrets with wo_version arguments, and the current feature gap for cross-system secret handoff. Each scenario includes concrete HCL code examples and notes on edge cases like token regeneration behavior.

• •Ephemeral resources replace data sources and variables that store secrets in state
• •Dynamic secrets require wo_version arguments since ephemerals regenerate on every plan/apply
• •Cross-system secret handoff remains a feature gap for ephemerals

Generated with AI, which can make mistakes.