Storing sensitive data like database passwords and API keys in Terraform state files poses significant security risks. Terraform 1.10 introduced the ephemeral resource to address this issue, allowing dynamic retrieval of sensitive values during runtime without persisting them in the state file.
Resources
Ephemeral resources are defined using a new block type in HCL:
ephemeral "<resource type>" "<resource name>" {
# attributes and nested blocks
}
These resources are referenced similarly to data sources but are not stored in the state file. Attributes and nested blocks will vary per provider implementation; however, they are referenced similarly to data sources.
Example: Using AWS Secrets Manager with Postgres
In this example, the database credentials are retrieved from AWS Secrets Manager and used to configure the PostgreSQL provider without being stored in the state file.
data "aws_secretsmanager_secret" "example" {
name = "myprodsecret"
}
ephemeral "aws_secretsmanager_secret_version" "db" {
secret_id = data.aws_secretsmanager_secret.example.arn
}
locals {
credentials = jsondecode(ephemeral.aws_secretsmanager_secret_version.db.secret_string)
}
provider "postgresql" {
host = "1.2.3.4"
port = "5432"
username = local.credentials["username"]
password = local.credentials["password"]
}
data "postgresql_tables" "my_tables" {
database = "postgres"
}
output "tables" {
value = data.postgresql_tables.my_tables.tables.*.object_name
}
If we examine the items in the state, there is no reference to aws_secretsmanager_secret_version.
# terraform state list
data.aws_secretsmanager_secret.example
data.postgresql_tables.my_tables
Supported Providers
At the time of writing, the current supported ephemeral blocks are:
- .↗ Original-Artikel auf dev.to lesenVollständiger Original-BerichtAusführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf dev.to.
SOCIAL SHARE CARD GENERATOR