Credentials and variables

Terraform needs two things from the pipeline: access to your cloud and state backend, and values for your input variables. In short:

AWS and Google: integrations

Select an AWS or Google Service Account integration in the Backend tab of the action (backend AMAZON or GOOGLE). One integration gives access to both the state storage (S3 or GCS) and the resources you manage - the provider reads the same credentials. No keys in the repository or in variables.

An AWS integration can use OIDC, so the run gets short-lived credentials instead of static keys.

Secrets

Don't keep secrets in the repository - not in .tf files and not in .tfvars. Add them as secret variables in the pipeline or the action. Secret variables are masked in the logs.

Input variables. Name the Buddy variable TF_VAR_<name>, and Terraform uses it as var.<name>. A secret variable TF_VAR_db_password sets:

hcl
variable "db_password" {
  type      = string
  sensitive = true
}

With sensitive = true, the resource diff shows (sensitive value) instead of the value.

Credentials for other providers. Use the variable names the provider expects:

Non-secret values

Keep values that aren't secret - instance sizes, regions, names - in .tfvars files in the repository. terraform.tfvars and *.auto.tfvars are loaded automatically. To pick a file per environment, set it in additional_args of the Plan action:

yaml
additional_args: -var-file=env/prod.tfvars

Private modules and registries

• Private registry or HCP Terraform: add TF_TOKEN_<hostname> as a secret variable, for example TF_TOKEN_app_terraform_io.
• Modules from a private Git repository: the image needs git and access to the repository. If the official image doesn't have what you need, use a custom image.