Provider Ephemeral Resources
Implement Terraform provider ephemeral resources with the Plugin Framework: the...
Install
npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -g -a claude-code -y- Repository
- hashicorp/agent-skills911
- Category
- Design
- Updated
- 7d ago
- License
- MPL-2.0
- Context cost
- Mediumabout 2,148 tokens
- Runs scripts
- No, instructions only
What it does
Implement Terraform provider ephemeral resources with the Plugin Framework: the Open/Renew/Close lifecycle, ephemeral schema design, registration via EphemeralResources, renewal for expiring credentials, and how ephemeral values flow into write-only attributes and provider configuration. Use when adding an ephemeral resource, exposing secrets/tokens/certificates that must never persist in state or plan, deciding between an ephemeral resource and a data source, or wiring short-lived credentials from one provider into another.
Terraform Provider Ephemeral Resources
Ephemeral resources (Terraform 1.10+) produce values that are never persisted to state or plan. They exist for exactly one job: handing secrets, tokens, generated passwords, short-lived certificates, decrypted values, to the parts of a configuration that need them, without writing them to disk. Any data source that returns a sensitive value is a candidate to be (or to also exist as) an ephemeral resource.
Official docs: Ephemeral Resources.
When to Use One
| Situation | Use |
|---|---|
| Read-only lookup of non-sensitive data | Data source |
| Value is sensitive and only needed at apply time (DB password for a provider block, token for a write-only attribute) | Ephemeral resource |
| Sensitive value that downstream managed resources must store (e.g. as an attribute) | Regular resource/data source, but pair with write-only attributes where possible |
| Credential that expires mid-operation (STS-style tokens, short-TTL leases) | Ephemeral resource with Renew |
Ephemeral results can be used in provider configuration, write-only attributes, provisioner configuration, and other ephemeral contexts, but not in regular attributes, because those persist to state.
Lifecycle
Terraform calls up to three methods per operation:
