How can we pass HashiCorp Vault secrets, k/v username/password and feed Terraform while its creating Ec2 instance.

For example, i don't want to use in plain text

variable "myvariable" {
default = "mypassword"

Using token yea, but what resource should call Vault and ask for secrets which would be injected on creation time.

1 Answer 1


The simplest case is to use the Terraform Vault Provider (https://www.terraform.io/docs/providers/vault/index.html) - which, caveat, I've not used myself.

Example from the Terraform site:

provider "vault" {
  # It is strongly recommended to configure this provider through the
  # environment variables described above, so that each user can have
  # separate credentials set in the environment.
  # This will default to using $VAULT_ADDR
  # But can be set explicitly
  # address = "https://vault.example.net:8200"

resource "vault_generic_secret" "example" {
  path = "secret/foo"

  data_json = <<EOT
  "foo":   "bar",
  "pizza": "cheese"

Optionally you can write a script in whatever language you are comfortable with to make the call out to Vault and invoke via local-exec in Terraform.

Example of invoking a simple command from the Terraform site:

resource "aws_instance" "web" {
  # ...

  provisioner "local-exec" {
    command = "echo ${aws_instance.web.private_ip} >> private_ips.txt"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.