Agent skill · hashicorp
provider-configuration
Implement Terraform provider configuration and authentication with the Plugin Framework: provider schema for credentials (Optional + Sensitive attributes), environment variable fallbacks, credential provider chains (static config, then environment variables, shared credentials file, and platform identity), unknown-value guards in Configure(), secret redaction, configure-time credential validation, and diagnostics that name every source tried. Use when implementing or reviewing a provider's Configure method or provider schema, adding authentication options (API keys, tokens, profiles, credentials files, assume-role), deciding how a provider should resolve credentials, debugging "no valid credential sources" or missing-credentials errors, or unit testing credential resolution.
What it needs
About 7k tokens when loaded.
What this skill does
Terraform Provider Configuration and Authentication How a provider accepts connection settings and resolves credentials. Poor authentication UX is the first thing every user of a provider hits; a well-designed credential provider chain is what separates a production-grade provider from a demo. The examples use a fictional examplecloud provider and the Plugin Framework. References (load when needed): references/credential-chain.md — complete, compilable credential chain implementation (providers, chain, file profiles, Configure wiring, tests) references/case-studies.md — how the AWS provider (aws-sdk-go-base) and smaller providers structure real credential chains --- Provider Schema for Authentication Every authentication attribute must be Optional, never Required — a Required attribute forces users to put credentials in configuration and makes environment-variable and credentials-file resolution impossible. Mark secrets Sensitive so Terraform redacts them in plan output, and state the environment-variable fallback in each description so tfplugindocs publishes the resolution rules. Never add a Default to a credential attribute, and never hardcode a credential anywhere in the provider. Defaults belong in the resolution logic (where environment variables and files can override them), not in the schema. The Credential Provider Chain Resolve credentials by consulting an ordered list of sources and taking the first one that produces a complete set. This is the pattern the AWS provider uses via aws-sdk-go-base, and it generalizes to any provider. The canonical precedence, highest first: 1. Static configuration — values set directly in the provider block. Explicit always wins. 2. Environment variables — EXAMPLECLOUDAPIKEY, etc. The CI-friendly path. 3. Shared credentials file — named profiles in ~/.examplecloud/credentials, for humans with multiple accounts. 4. Platform identity — instance metadata, workload identity, or OIDC token exchange, where the platform offers it. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills hashicorp/provider-configuration