Terraform Ephemeral values (ephemeral)

ephemeral (tf.io)

Official password

ephemeral "random_password" "db_password" {
 length           = 16
 override_special = "!#$%&*()-_=+[]{}<>:?"
}

resource "aws_secretsmanager_secret" "db_password" {
 name = "db_password"
}

resource "aws_secretsmanager_secret_version" "db_password" {
 secret_id                = aws_secretsmanager_secret.db_password.id
 secret_string_wo         = ephemeral.random_password.db_password.result
 secret_string_wo_version = 1
}

ephemeral "aws_secretsmanager_secret_version" "db_password" {
 secret_id = aws_secretsmanager_secret_version.db_password.secret_id
}

resource "aws_db_instance" "example" {
 instance_class      = "db.t3.micro"
 allocated_storage   = "5"
 engine              = "postgres"
 username            = "example"
 skip_final_snapshot = true
 password_wo         = ephemeral.aws_secretsmanager_secret_version.db_password.secret_string
 password_wo_version = aws_secretsmanager_secret_version.db_password.secret_string_wo_version
}

Related

• Terraform 1.11 brings ephemeral values to managed resources with write-only arguments
• Terraform 1.10 improves handling secrets in state with ephemeral values: ephemeral

See also

• terraform version, Terraform changelog
• ephemeral, Terraform 1.10 improves handling secrets in state with ephemeral values
• Terraform security