Answers: <p>The simplest case is to use the Terraform Vault Provider (<a href="https://www.terraform.io/docs/providers/vault/index.html" rel="nofollow noreferrer">https://www.terraform.io/docs/providers/vault/index.html</a>) - which, caveat, I've not used myself. </p>
  
  <p>Example from the Terraform site:</p>
  
  <pre><code>provider "vault" {
    # It is strongly recommended to configure this provider through the
    # environment variables described above, so that each user can have
    # separate credentials set in the environment.
    #
    # This will default to using $VAULT_ADDR
    # But can be set explicitly
    # address = "https://vault.example.net:8200"
  }
  
  resource "vault_generic_secret" "example" {
    path = "secret/foo"
  
    data_json = &lt;&lt;EOT
  {
    "foo":   "bar",
    "pizza": "cheese"
  }
  EOT
  }
  </code></pre>
  
  <p>Optionally you can write a script in whatever language you are comfortable with to make the call out to Vault and invoke via local-exec in Terraform. </p>
  
  <p>Example of invoking a simple command from the Terraform site:</p>
  
  <pre><code>resource "aws_instance" "web" {
    # ...
  
    provisioner "local-exec" {
      command = "echo ${aws_instance.web.private_ip} &gt;&gt; private_ips.txt"
    }
  }
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2019-02-12T17:44:44.910Z
Answers: 2019-02-12T17:44:44.910Z
Answers: Absurdly
Body: <p>How can we pass HashiCorp Vault secrets, k/v username/password and feed Terraform while its creating Ec2 instance.</p>
  
  <p>For example, i don't want to use in plain text</p>
  
  <pre><code>variable "myvariable" {
  default = "mypassword"
  }
  </code></pre>
  
  <p>Using token yea, but what resource should call Vault and ask for secrets which would be injected on creation time.</p>
  
Tags: <amazon-web-services><amazon-ec2><terraform><hashicorp-vault>
Title: How to pass HashiCorp Vault secrets(k/v passwords) to Terraform EC2 instance
UserDisplayName: Dejan Bodiroga
ThreadText: # How to pass HashiCorp Vault secrets(k/v passwords) to Terraform EC2 instance
  
  (Asked by: username_0 on 2019-02-12)
  
  How can we pass HashiCorp Vault secrets, k/v username/password and feed Terraform while its creating Ec2 instance.
  
  For example, i don't want to use in plain text
  
  ```
  variable "myvariable" {
  default = "mypassword"
  }
  
  ```
  
  Using token yea, but what resource should call Vault and ask for secrets which would be injected on creation time.
  
  **Tags:** amazon-web-services, amazon-ec2, terraform, hashicorp-vault
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-02-12. Score: 1
  
  The simplest case is to use the Terraform Vault Provider (<https://www.terraform.io/docs/providers/vault/index.html>) - which, caveat, I've not used myself.
  
  Example from the Terraform site:
  
  ```
  provider "vault" {
    # It is strongly recommended to configure this provider through the
    # environment variables described above, so that each user can have
    # separate credentials set in the environment.
    #
    # This will default to using $VAULT_ADDR
    # But can be set explicitly
    # address = "https://vault.example.net:8200"
  }
  
  resource "vault_generic_secret" "example" {
    path = "secret/foo"
  
    data_json = <<EOT
  {
    "foo":   "bar",
    "pizza": "cheese"
  }
  EOT
  }
  
  ```
  
  Optionally you can write a script in whatever language you are comfortable with to make the call out to Vault and invoke via local-exec in Terraform.
  
  Example of invoking a simple command from the Terraform site:
  
  ```
  resource "aws_instance" "web" {
    # ...
  
    provisioner "local-exec" {
      command = "echo ${aws_instance.web.private_ip} >> private_ips.txt"
    }
  }
  
  ```
  
  
  ---
  
  