dynamic provider credentials

Short-lived cloud credentials that an HCP Terraform run obtains with a signed identity token instead of stored keys.

Without them, long-lived cloud keys stored in workspace variables become a standing target.

In more detail

Each run presents a workload identity token to the cloud provider or Vault and receives credentials that expire soon after. No long-lived access key sits in a workspace variable, so there is nothing static to leak or rotate.

Example

TFC_AWS_PROVIDER_AUTH = true

Related terms

• access key — A long-lived cloud credential made of a key ID and a secret key that works until someone deletes it.
• HCP Terraform workspace — The HCP Terraform container for one collection of infrastructure: its configuration source, variables, state, run history and team access.

Taught in

• Collaboration And Governance: Teams, Policies, Registry And Health — HashiCorp Terraform Associate (004) Exam Prep

References

• HCP Terraform: Dynamic provider credentials

Certification courses

• Terraform Associate course and practice exam: HashiCorp Terraform Associate (004)