> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nebius.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to work with sensitive values in the Terraform provider by Nebius AI Cloud

Terraform offers a declarative approach, which enables you to describe the desired infrastructure state and store it in the `.tfstate` file. This file contains a complete snapshot of your infrastructure. Therefore, it must be stored securely, for example, in a private S3 bucket. However, for some sensitive values, even S3 isn't secure enough.

To increase the security level, use [write-only arguments](https://developer.hashicorp.com/terraform/language/resources/ephemeral/write-only) and [ephemeral variables and resources](https://developer.hashicorp.com/terraform/language/resources/ephemeral). They allow you to pass sensitive data to the Terraform provider without storing it anywhere.

## Prerequisites

[Upgrade Terraform](https://developer.hashicorp.com/terraform/install) to version 1.11 or later.

## Write-only arguments

### How to use write-only arguments

To put sensitive data to write-only arguments, move the parameters you want to protect to the `sensitive` object. For example, you [create a Managed Service for MLflow cluster](/mlflow/clusters/manage#terraform), and you want to secure its password. Usually, the password is specified at the first level of the resource configuration. To protect the password, move it to the `sensitive` object:

```hcl theme={null}
resource "nebius_msp_mlflow_v1alpha1_cluster" "test_cluster" {
  name           = "test_cluster"
  parent_id      = "<project_ID>"
  admin_username = "user"
  admin_password = "password"         # [!code --]
  sensitive = {                       # [!code ++]
    admin_password = "password"       # [!code ++]
  }                                   # [!code ++]
  ...
}
```

### How to update write-only arguments

Since write-only arguments are excluded from the `.tfstate` file, Terraform can't detect changes in them at the plan phase (`terraform plan`). To update write-only arguments, use the `sensitive.version` parameter. If you didn't have it before and you add it, or if you increase the version, Terraform recognizes this change and treats it as a resource update.

```hcl highlight={6} theme={null}
resource "nebius_msp_mlflow_v1alpha1_cluster" "test_cluster" {
  name      = "test_cluster"
  parent_id = "<project_ID>"
  admin_username = "user"
  sensitive = {
    version        = "1"
    admin_password = "password"
  }
  ...
}
```

<Warning>
  Run `terraform plan` before you apply changes in write-only arguments. Changes of some parameters may lead to a resource replacement.
</Warning>

## Ephemeral variables and resources

Ephemeral variables and resources can be used in other ephemeral objects, write-only arguments or provider settings:

* For ephemeral variables, you only enter their values when you run `terraform plan` and `terraform apply`. Terraform doesn't save these values to the `.tfstate` file.
* For ephemeral resources, Terraform creates them automatically when they are required. For example, when you're updating a resource that uses ephemeral resources and you're applying a new configuration for it.

### How to use ephemeral variables

Create a variable by using `ephemeral = true` and reuse this variable in a write-only argument in the `sensitive` object. This way, Terraform prompts you to enter the value of the variable when you apply the configuration. For example:

```hcl highlight={3,12} theme={null}
variable "secret" {
  type      = string
  ephemeral = true
}

resource "nebius_msp_mlflow_v1alpha1_cluster" "test_cluster" {
  name      = "test_cluster"
  parent_id = "<project_ID>"
  admin_username = "user"
  sensitive = {
    version        = "1"
    admin_password = var.secret
  }
  ...
}
```

To avoid prompts when using ephemeral variables, supply values in environment variables. For example:

```bash theme={null}
export TF_VAR_secret="<secret_value>"
```

### How to use ephemeral resources

Another alternative is ephemeral resources, which you can also use in write-only arguments. For example, you can set a TLS private key in the key-value payload of a [MysteryBox secret](/mysterybox/overview#secrets-and-versions):

```hcl highlight={1,15} theme={null}
ephemeral "tls_private_key" "rsa_4096_example" {
  algorithm = "RSA"
  rsa_bits  = 4096
}

resource "nebius_mysterybox_v1_secret" "avvv_secret_tf" {
  parent_id   = "project-e00x6706bdmd42yjyn"
  description = "TF test"
  name        = "avvv-secret-tf"
  sensitive = {
    secret_version = {
      payload = [
        {
          key          = "mlflow_password"
          string_value = ephemeral.tls_private_key.rsa_4096_example.private_key_pem
        }
      ]
    }
  }
}
```

After you create the secret, you can [get and see its payload](/mysterybox/secrets/get#how-to-get-a-payload).

### How to update ephemeral variables and resources

Since Terraform doesn't store values of ephemeral variables and resources in the `.tfstate` file, use a hash that tracks changes in them. This way, you can update ephemeral resources, or values of ephemeral variables that are set in environment variables.

If ephemeral variables are prompted when you run `terraform plan` and `terraform apply`, you don't need the hash — just set another value in the prompt.

To use the hash and update the variables and resources:

1. Add the `versioned_ephemeral_values` object to `provider "nebius"`.
2. Add the `nebius_hash` resource to hash the variable.
3. Set the hash to the `sensitive.version` parameter.

```hcl highlight={7,12,21} theme={null}
variable "secret" {
  type      = string
  ephemeral = true
}

provider "nebius" {
  versioned_ephemeral_values = {
    "secret_to_hash" = var.secret
  }
}

resource "nebius_hash" "secret_hash" {
  name = "secret_to_hash"
}

resource "nebius_msp_mlflow_v1alpha1_cluster" "test_cluster" {
  name      = "test_cluster"
  parent_id = "<project_ID>"
  admin_username = "user"
  sensitive = {
    version        = resource.nebius_hash.secret_hash.hash
    admin_password = var.secret
  }
  ...
}
```