# Provider Ephemeral Resources

Implement Terraform provider ephemeral resources with the Plugin Framework: the...

- Repository: https://github.com/hashicorp/agent-skills (911 stars)
- Category: Design
- License: MPL-2.0
- Last updated: 2026-10-28
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -g -a claude-code -y`
Codex: `npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -g -a codex -y`
Cursor: `npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -g -a cursor -y`
Gemini CLI: `npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add hashicorp/agent-skills`

## Description

Implement Terraform provider ephemeral resources with the Plugin Framework: the Open/Renew/Close lifecycle, ephemeral schema design, registration via EphemeralResources, renewal for expiring credentials, and how ephemeral values flow into write-only attributes and provider configuration. Use when adding an ephemeral resource, exposing secrets/tokens/certificates that must never persist in state or plan, deciding between an ephemeral resource and a data source, or wiring short-lived credentials from one provider into another.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Terraform Provider Ephemeral Resources

Ephemeral resources (Terraform 1.10+) produce values that are **never
persisted to state or plan**. They exist for exactly one job: handing
secrets, tokens, generated passwords, short-lived certificates, decrypted
values, to the parts of a configuration that need them, without writing
them to disk. Any data source that returns a sensitive value is a candidate
to be (or to also exist as) an ephemeral resource.

Official docs: [Ephemeral Resources](https://developer.hashicorp.com/terraform/plugin/framework/ephemeral-resources).

## When to Use One

| Situation | Use |
|---|---|
| Read-only lookup of non-sensitive data | Data source |
| Value is sensitive and only needed at apply time (DB password for a provider block, token for a write-only attribute) | Ephemeral resource |
| Sensitive value that downstream *managed resources* must store (e.g. as an attribute) | Regular resource/data source, but pair with write-only attributes where possible |
| Credential that expires mid-operation (STS-style tokens, short-TTL leases) | Ephemeral resource with `Renew` |

Ephemeral results can be used in provider configuration, write-only
attributes, provisioner configuration, and other ephemeral contexts, but
not in regular attributes, because those persist to state.

## Lifecycle

Terraform calls up to three methods per operation:

The rest: https://github.com/hashicorp/agent-skills/blob/HEAD/plugins/terraform/skills/provider-ephemeral-resources/SKILL.md