HCP Vault Secrets with Terraform
In addition to using the command line interface (CLI) or application programming interface (API), you can also use the HCP Terraform provider to retrieve secrets from HCP Vault Secrets.
Prerequisites
- An existing HCP account
- Completed the previous HCP Vault Secrets tutorials
- HCP service principal with
HCP_CLIENT_ID
andHCP_CLIENT_SECRET
available - Terraform installed
- HCP Terraform account (HCP Terraform workflow only)
Retrieve secrets with Terraform
The HCP Terraform provider includes a data source for HCP Vault Secrets. This data source allows you to retrieve secrets and use them in a Terraform configuration.
In this example, you will make use of HCP Terraform variable sets, and
place all other required parameters in the Terraform configuration. This is done
to give you a full picture of the required parameters. You can also choose to
set the HCP_CLIENT_ID
, HCP_CLIENT_SECRET
, and TF_CLOUD_ORGANIZATION
variables in your local shell.
Retrieve the
HCP_CLIENT_ID
andHCP_CLIENT_SECRET
environment variables set during the Install HCP CLI for Vault Secrets tutorial.Log into the HCP Terraform portal and select your organization.
Select Settings > Variable sets from the left navigation. Variables in HCP Terraform allow you to store items similar to setting an environment variable for a shell session or in a .tfvars file.
Click Create variable set.
Enter
HCP_SERVICE_PRINCIPAL
in the Name textbox.Select the Apply globally radio button.
Click + Add variable.
Enter
HCP_CLIENT_ID
in the Key field, and the actual client ID in the Value field.Click the Sensitive checkbox, then click Add variable.
Click + Add variable again.
Enter
HCP_CLIENT_SECRET
in the Key field, and the actual client secret in the Value field.Click the Sensitive checkbox, then click Add variable.
Click Create variable set.
Click < Workspaces to return to the Workspace landing page.
Click New and select Workspace.
Select CLI-driven workflow and enter
HCPVaultSecretsLab
in the Workspace name field.Scroll to the bottom of the form and click Create workspace.
Copy the name of your HCP Terraform organization and return to your terminal session.
Set an environment variable with the name of your HCP Terraform organization.
Create an example Terraform configuration with the required provider and HCP Terraform configuration block. The HCP Vault Secrets data source requires the
hcp
provider at version0.63.0
or greater.Note
This tutorial was tested using version 0.91.0 of the HCP Terraform provider. You can check for the latest version of the provider in the Terraform Registry.
Declare the
HCP_CLIENT_ID
andHCP_CLIENT_SECRET
variables in the Terraform configuration.Add the
hcp_vault_secrets_app
data block to the Terraform configuration to read theWebApplication
application you created in an earlier tutorial.Add an output block to allow Terraform to display the retrieved secret. This step is not necessary for production configurations, but used in this tutorial to validate that Terraform successfully retrieved the secret.
Because you will use HCP Vault Secrets to store sensitive information, you must add
sensitive = true
to the output block.Log in to HCP Terraform with the
login
sub-command. Follow the prompts to complete the authentication process.Run
terraform init
to initialize the configuration and install the necessary providers.Run
terraform apply
to read the WebApplication values from HCP Vault Secrets.Return to the HCP Terraform portal.
On the Overview page you can see the Latest Run is in a stage of Applied.
Click See details.
Expand Apply finished.
Click the State versions created: link.
The
username
secret you previously added is displayed.