Explore Every Azure Technology in a Single Hub

Ephemeral resources in Terraform 1.10 mark a major leap forward for secure infrastructure management. These special resources never make their way into the state file. Instead, they disappear when no longer needed—making them ideal for handling secrets and other confidential information. The real benefit? Even if your Terraform state file is exposed, your sensitive data remains protected.

At present, only select providers support ephemeral resources in Terraform 1.10. These include:

• Microsoft Azure (azurerm):
  • azurerm_key_vault_secret
  • azurerm_key_vault_certificate
• Kubernetes (kubernetes):
  • kubernetes_token_request
  • kubernetes_certificate_signing_request

As this new capability gains popularity, more providers are likely to add support soon.

How to Create Ephemeral Resources in Terraform 1.10
You can declare an ephemeral resource using a special ephemeral block in your HCL file. The usage looks almost identical to regular resources:

The available properties and nested blocks for an ephemeral resource depend on the resource type—just as they do for standard resources.

How to Reference Ephemeral Resources

You can use ephemeral resources just like data sources. Prefix references with ephemeral. For example:

ephemeral “azurerm_key_vault_secret” “secret” {
  # attributes
}


To fetch its attributes, use ephemeral.azurerm_key_vault_secret.secret.<attribute> in your configuration.

Where Can You Use Ephemeral Resources?
Ephemeral resources in Terraform 1.10 can only be used in contexts where their values do not end up in the state file. These contexts are:

• Other ephemeral resource blocks
• Local values
• Ephemeral variable and output blocks (see below)
• Provider configurations inside provider blocks
• Provisioner and connection blocks within standard resources

These restrictions ensure sensitive data remains protected. Using ephemeral resources elsewhere would undermine their core security advantage.



When you reference an ephemeral resource in a local value, Terraform 1.10 automatically treats that local as ephemeral too. You can’t create ephemeral locals directly; they are formed only through ephemeral references.

Example: Using Ephemeral Resources in Terraform 1.10

# Retrieve secrets from AWS Secrets Manager
ephemeral “aws_secretsmanager_secret_version” “secret” {
  secret_id = “<secret id>”
}

locals {
  # Convert the JSON secret to usable credentials
  credentials = jsondecode(ephemeral.aws_secretsmanager_secret_version.db.secret_string)
}

# Set up PostgreSQL with secure ephemeral credentials
provider “postgresql” {
  host     = “<postgres endpoint>”
  port     = 5432
  username = local.credentials[“username”]
  password = local.credentials[“password”]
}


In this example, the ephemeral block securely pulls a password from AWS Secrets Manager. The credentials are made available for the PostgreSQL provider—without persisting them in the state file.



Meta-Arguments Supported by Ephemeral Resources in Terraform 1.10


When working with ephemeral resources, you can use a selection of meta-arguments:

• depends_on: define dependencies for orchestration
• count: deploy multiple identical ephemeral resources
• for_each: create one ephemeral resource per value in a list or map
• provider: select a particular provider alias
• lifecycle: link to resource lifecycle actions

However, ephemeral resources do not allow the provisioner meta-argument, supporting best practices in Terraform workflows.

The Lifecycle of Ephemeral Resources in Terraform 1.10


Ephemeral resources behave differently from regular resources or data sources. They are activated when Terraform needs their data and deactivated as soon as they are no longer required. The activation and deactivation steps vary across different services.



For instance, using HashiCorp Vault, Terraform 1.10 activates a secret by leasing it and deactivates by revoking that lease. The essence of ephemeral resources is that their data never occupies the state file.

Troubleshooting: Common Issues with Ephemeral Resources in Terraform 1.10

If your references to ephemeral resources don’t work, ensure you haven’t tried using their values in outputs or resource attributes that are saved in the state file. This will trigger an error. To resolve, restrict ephemeral resource usage to supported contexts like variables, locals, and provider blocks. If you encounter unsupported-provider errors, check your provider version and look for updates enabling ephemeral support.

Conclusion: Why Ephemeral Resources in Terraform 1.10 Matter
Ephemeral resources add serious value to your Terraform 1.10 workflow by keeping secrets and sensitive data safely out of your state files. While some sensitive mapping data will still exist in state, using ephemeral resources in Terraform 1.10 greatly reduces risk. Configure your infrastructure with greater confidence—and get ahead of evolving security demands.



As more providers implement support, adopting ephemeral resources in Terraform 1.10 will soon become standard best practice.