# Credentials and variables

Give Terraform actions in Buddy access to AWS and Google with integrations, keep secrets in Buddy variables, and pass inputs with TF_VAR_ and tfvars files.

Terraform needs two things from the pipeline: **access** to your cloud and state backend, and **values** for your input variables. In short:

| What | Where to set it |
| :--- | :--- |
| Access to AWS or Google Cloud | An integration in the **Backend** tab of the action |
| Access to other providers (Azure, Cloudflare, ...) | Secret variables in the pipeline or action |
| Secrets (passwords, tokens) | Secret variables in the pipeline or action |
| Non-secret values | `.tfvars` files in the repository |

## AWS and Google: integrations

Select an [AWS](/docs/integrations/amazon-web-services/amazon.md) or [Google Service Account](/docs/integrations/google-cloud/google-cloud.md) integration in the **Backend** tab of the action (backend `AMAZON` or `GOOGLE`). One integration gives access to both the state storage (S3 or GCS) and the resources you manage - the provider reads the same credentials. No keys in the repository or in variables.

An AWS integration can use [OIDC](/docs/integrations/amazon-web-services/oidc.md), so the run gets short-lived credentials instead of static keys.

<Hint type="info">

The integration in the **Backend** tab gives access to the cloud. The integration in the action's custom image settings is only used to pull the image, for example from Amazon ECR.

</Hint>

## Secrets

Don't keep secrets in the repository - not in `.tf` files and not in `.tfvars`. Add them as [secret variables](/docs/basics/secrets-encryption/variable-encryption.md) in the pipeline or the action. Secret variables are masked in the logs.

**Input variables.** Name the Buddy variable `TF_VAR_<name>`, and Terraform uses it as `var.<name>`. A secret variable `TF_VAR_db_password` sets:

```hcl
variable "db_password" {
  type      = string
  sensitive = true
}
```

With `sensitive = true`, the [resource diff](/docs/terraform/plan-and-apply.md#the-resource-diff) shows `(sensitive value)` instead of the value.

**Credentials for other providers.** Use the variable names the provider expects:

| Provider | Variables |
| :--- | :--- |
| Azure | `ARM_CLIENT_ID`, `ARM_CLIENT_SECRET`, `ARM_TENANT_ID`, `ARM_SUBSCRIPTION_ID` |
| Cloudflare | `CLOUDFLARE_API_TOKEN` |
| DigitalOcean | `DIGITALOCEAN_TOKEN` |

<Hint type="warning">

Don't pass secrets with `-var=` in `additional_args`. They aren't masked and can appear in the logs and in the diff.

</Hint>

## Non-secret values

Keep values that aren't secret - instance sizes, regions, names - in `.tfvars` files in the repository. `terraform.tfvars` and `*.auto.tfvars` are loaded automatically. To pick a file per environment, set it in `additional_args` of the Plan action:

```yaml
additional_args: -var-file=env/prod.tfvars
```

## Private modules and registries

- **Private registry or HCP Terraform:** add `TF_TOKEN_<hostname>` as a secret variable, for example `TF_TOKEN_app_terraform_io`.
- **Modules from a private Git repository:** the image needs `git` and access to the repository. If the official image doesn't have what you need, use a [custom image](/docs/terraform/versions.md#custom).


---
Original source: https://buddy.works/docs/terraform/credentials-and-variables