Today marks a significant milestone for HashiCorp with the general release of Terraform version 1.10. This new version is now available for download and immediate use through the HashiCorp Cloud Platform (HCP) Terraform. The update introduces several noteworthy features, most prominently the concept of ephemeral values, which are designed to enhance the secure handling of sensitive information. This article will explore these features in detail and provide context for their implications.

Enhanced Security with Ephemeral Values

Terraform is a powerful tool used for managing infrastructure, and part of its functionality involves dealing with sensitive data, such as private keys, certificates, and API tokens. For instance, you might use a data source to retrieve a secret and assign it to a resource attribute, or a resource might generate a secret, like a random password, which then gets stored in a secrets manager.

Previously, these secrets were stored in Terraform’s plan or state files in plaintext. This meant that if these files were accessed inappropriately, the secrets could be compromised. To address this security vulnerability, Terraform 1.10 introduces ephemeral values. These values are designed not to be stored in any artifact, such as the plan or state files, ensuring they are not retained between different phases of Terraform operations.

Key Features of Ephemeral Values

Ephemeral values offer several new constructs within the Terraform language to enhance security:

1. Ephemeral Input and Output Variables: In a manner similar to marking a variable as sensitive, you can now mark input and output variables as ephemeral. This is particularly useful for data that needs to exist only temporarily, such as short-lived tokens or session identifiers.
2. Ephemeral Resources: This introduces a new resource mode that exists alongside managed resources and data resources. Ephemeral resources are declared using ephemeral blocks, which specify that a resource needs to be created or retrieved separately in each Terraform phase. The resource is then used to configure another ephemeral object and must be closed explicitly before the phase ends.
3. Managed Resources’ Write-Only Attribute: This new attribute allows a property to be written to but not read from. This functionality will be available in Terraform 1.11.

   Ephemeral values mark a significant advancement in how Terraform helps users manage their infrastructure securely. Whether generating credentials, retrieving tokens, or setting up temporary network tunnels, ephemeral values ensure that sensitive information is not persisted in Terraform artifacts.

   Practical Application of Ephemeral Values
   

   To illustrate the practical application of ephemeral values, consider using an ephemeral resource to fetch a secret from AWS Secrets Manager. This secret is then used to initialize the PostgreSQL provider. Prior to Terraform 1.10, a data source would fetch the secret, resulting in the secret being stored in both the plan and state files. With ephemeral values, the secret remains secure because it is no longer stored in any artifact.

   Available Features in Terraform 1.10
   

   The Terraform 1.10 release encompasses a range of features, including ephemeral input and output variables, ephemeral resources, and new functions such as ephemeralasnull and terraform.applying. Currently, ephemeral resources are available for three different providers:

   • AWS: The aws_secretsmanager_secret_version and aws_lambda_invocation are two of the ephemeral resources available.
   • Azure: Ephemeral resources include azurerm_key_vault_secret and azurerm_key_vault_certificate.
   • Kubernetes: This includes kubernetes_token_request and kubernetes_certificate_signing_request.

     These ephemeral resources are also accessible through the AWS, Azure, Kubernetes, and random providers. Support for Google Cloud is anticipated by December 9th, with available resources to include google_service_account_access_token, google_service_account_id_token, google_service_account_jwt, and google_service_account_key.

     Other Improvements and Next Steps
     

     Beyond ephemeral values, Terraform 1.10 brings additional enhancements, all of which are detailed in the changelog. A major focus in this release is performance improvement:

   • Performance Enhancements: The refactoring of plan changes and reduction of repeated decoding in resource states aim to improve the efficiency of plan and apply operations. This change is expected to alleviate performance issues when dealing with a large number of resource instances.

     To begin utilizing HashiCorp Terraform, users can download the latest version and explore the new features. The ongoing development and enhancement of Terraform are largely thanks to the feedback from the community, received through GitHub issues, HashiCorp Discuss forums, and customer input.

     In conclusion, Terraform 1.10 offers a significant leap forward in secure infrastructure management, with ephemeral values providing a robust solution for handling secrets. Users can look forward to improved security, performance, and an expanded range of functionalities, solidifying Terraform’s position as a leading infrastructure-as-code tool.

For more Information, Refer to this article.