Terraform offers a declarative approach, which enables you to describe the desired infrastructure state and store it in the .tfstate file. This file contains a complete snapshot of your infrastructure. Therefore, it must be stored securely, for example, in a private S3 bucket. However, for some sensitive values, even S3 isn’t secure enough.
To increase the security level, use write-only arguments and ephemeral variables and resources. They allow you to pass sensitive data to the Terraform provider without storing it anywhere.
Prerequisites
Upgrade Terraform to version 1.11 or later.
Write-only arguments
How to use write-only arguments
To put sensitive data to write-only arguments, move the parameters you want to protect to the sensitive object. For example, you create a Managed Service for MLflow cluster, and you want to secure its password. Usually, the password is specified at the first level of the resource configuration. To protect the password, move it to the sensitive object:
How to update write-only arguments
Since write-only arguments are excluded from the .tfstate file, Terraform can’t detect changes in them at the plan phase (terraform plan). To update write-only arguments, use the sensitive.version parameter. If you didn’t have it before and you add it, or if you increase the version, Terraform recognizes this change and treats it as a resource update.
Run terraform plan before you apply changes in write-only arguments. Changes of some parameters may lead to a resource replacement.
Ephemeral variables and resources
Ephemeral variables and resources can be used in other ephemeral objects, write-only arguments or provider settings:
- For ephemeral variables, you only enter their values when you run
terraform plan and terraform apply. Terraform doesn’t save these values to the .tfstate file.
- For ephemeral resources, Terraform creates them automatically when they are required. For example, when you’re updating a resource that uses ephemeral resources and you’re applying a new configuration for it.
How to use ephemeral variables
Create a variable by using ephemeral = true and reuse this variable in a write-only argument in the sensitive object. This way, Terraform prompts you to enter the value of the variable when you apply the configuration. For example:
To avoid prompts when using ephemeral variables, supply values in environment variables. For example:
How to use ephemeral resources
Another alternative is ephemeral resources, which you can also use in write-only arguments. For example, you can set a TLS private key in the key-value payload of a MysteryBox secret:
After you create the secret, you can get and see its payload.
How to update ephemeral variables and resources
Since Terraform doesn’t store values of ephemeral variables and resources in the .tfstate file, use a hash that tracks changes in them. This way, you can update ephemeral resources, or values of ephemeral variables that are set in environment variables.
If ephemeral variables are prompted when you run terraform plan and terraform apply, you don’t need the hash — just set another value in the prompt.
To use the hash and update the variables and resources:
- Add the
versioned_ephemeral_values object to provider "nebius".
- Add the
nebius_hash resource to hash the variable.
- Set the hash to the
sensitive.version parameter.
