<p>The simplest case is to use the Terraform Vault Provider (<a href="https://www.terraform.io/docs/providers/vault/index.html" rel="nofollow noreferrer">https://www.terraform.io/docs/providers/vault/index.html</a>) - which, caveat, I've not used myself. </p>

<p>Example from the Terraform site:</p>

<pre><code>provider "vault" {
  # It is strongly recommended to configure this provider through the
  # environment variables described above, so that each user can have
  # separate credentials set in the environment.
  #
  # This will default to using $VAULT_ADDR
  # But can be set explicitly
  # address = "https://vault.example.net:8200"
}

resource "vault_generic_secret" "example" {
  path = "secret/foo"

  data_json = &lt;&lt;EOT
{
  "foo":   "bar",
  "pizza": "cheese"
}
EOT
}
</code></pre>

<p>Optionally you can write a script in whatever language you are comfortable with to make the call out to Vault and invoke via local-exec in Terraform. </p>

<p>Example of invoking a simple command from the Terraform site:</p>

<pre><code>resource "aws_instance" "web" {
  # ...

  provisioner "local-exec" {
    command = "echo ${aws_instance.web.private_ip} &gt;&gt; private_ips.txt"
  }
}
</code></pre>

CC BY-SA 4.0
2019-02-12T17:44:44.910Z
2019-02-12T17:44:44.910Z
Absurdly
<p>How can we pass HashiCorp Vault secrets, k/v username/password and feed Terraform while its creating Ec2 instance.</p>

<p>For example, i don't want to use in plain text</p>

<pre><code>variable "myvariable" {
default = "mypassword"
}
</code></pre>

<p>Using token yea, but what resource should call Vault and ask for secrets which would be injected on creation time.</p>

<amazon-web-services><amazon-ec2><terraform><hashicorp-vault>
How to pass HashiCorp Vault secrets(k/v passwords) to Terraform EC2 instance
Dejan Bodiroga
# How to pass HashiCorp Vault secrets(k/v passwords) to Terraform EC2 instance

(Asked by: username_0 on 2019-02-12)

How can we pass HashiCorp Vault secrets, k/v username/password and feed Terraform while its creating Ec2 instance.
For example, i don't want to use in plain text
variable "myvariable" {
default = "mypassword"
}

Using token yea, but what resource should call Vault and ask for secrets which would be injected on creation time.

**Tags:** amazon-web-services, amazon-ec2, terraform, hashicorp-vault


---

## 1 answers

### Answer by username_1 on 2019-02-12. Score: 1

The simplest case is to use the Terraform Vault Provider (https://www.terraform.io/docs/providers/vault/index.html) - which, caveat, I've not used myself. 
Example from the Terraform site:
provider "vault" {
  # It is strongly recommended to configure this provider through the
  # environment variables described above, so that each user can have
  # separate credentials set in the environment.
  #
  # This will default to using $VAULT_ADDR
  # But can be set explicitly
  # address = "https://vault.example.net:8200"
}

resource "vault_generic_secret" "example" {
  path = "secret/foo"

  data_json = <
Optionally you can write a script in whatever language you are comfortable with to make the call out to Vault and invoke via local-exec in Terraform. 
Example of invoking a simple command from the Terraform site:
resource "aws_instance" "web" {
  # ...

  provisioner "local-exec" {
    command = "echo ${aws_instance.web.private_ip} >> private_ips.txt"
  }
}


---

