Terraform Ephemeral Values

Jul 13, 2025

#terraform

Released in Terraform 1.10, there is now a way to pass secrets to your resources without saving it in state.

The nice win being that you could have all your infrastructure in state, without having to encrypt the state file which HashiCorp does not reccomend

Ephemeral Resources in Action

The actual resource is pretty simple, it plugs in with certain resources you may already know about. The provider just needs to enable the functionality.

ephemeral "random_password" "db_password" {
  length           = 16
  override_special = "!#$%&*()-_=+[]{}<>:?"
}

# Or

ephemeral "aws_secretsmanager_secret_version" "db_password" {
  secret_id = aws_secretsmanager_secret_version.db_password.secret_id
}

You can’t just reference it with the value alone. You have to follow special rules. Specifically using wo_version and wo_value which translate to write only.

resource "aws_secretsmanager_secret_version" "db_password" {
  secret_id                = aws_secretsmanager_secret.db_password.id
  secret_string_wo         = ephemeral.random_password.db_password.result
  secret_string_wo_version = 1
}

resource "aws_db_instance" "example" {
  instance_class      = "db.t3.micro"
  ...
  password_wo         = ephemeral.aws_secretsmanager_secret_version.db_password.secret_string
  password_wo_version = aws_secretsmanager_secret_version.db_password.secret_string_wo_version
}

By appending wo_version or wo_value to the existing resources parameters (given that the provider enables this - had to say it a second time) you can use ephemeral resource functionality.

  • wo_value defines itself with the value.
  • wo_version holds a certain state. Where any change informs terraform that the value should be changed, thus write it again.

If you were to run terraform apply everything would proceed accordingly, except the operation would not show secrets, and either would the state file.

Gotcha’s

I have to repeat, the provider for your terraform resource needs to enable this. For example: https://github.com/hashicorp/terraform-provider-tls/issues/645