Agent skill · hashicorp
provider-ephemeral-resources
Implement Terraform provider ephemeral resources with the Plugin Framework: the Open/Renew/Close lifecycle, ephemeral schema design, registration via EphemeralResources, renewal for expiring credentials, and how ephemeral values flow into write-only attributes and provider configuration. Use when adding an ephemeral resource, exposing secrets/tokens/certificates that must never persist in state or plan, deciding between an ephemeral resource and a data source, or wiring short-lived credentials from one provider into another.
What it needs
About 4k tokens when loaded.
What this skill does
Terraform Provider Ephemeral Resources Ephemeral resources (Terraform 1.10+) produce values that are never persisted to state or plan. They exist for exactly one job: handing secrets — tokens, generated passwords, short-lived certificates, decrypted values — to the parts of a configuration that need them, without writing them to disk. Any data source that returns a sensitive value is a candidate to be (or to also exist as) an ephemeral resource. Official docs: Ephemeral Resources. When to Use One Situation Use --- --- Read-only lookup of non-sensitive data Data source Value is sensitive and only needed at apply time (DB password for a provider block, token for a write-only attribute) Ephemeral resource Sensitive value that downstream managed resources must store (e.g. as an attribute) Regular resource/data source — but pair with write-only attributes where possible Credential that expires mid-operation (STS-style tokens, short-TTL leases) Ephemeral resource with Renew Ephemeral results can be used in provider configuration, write-only attributes, provisioner configuration, and other ephemeral contexts — but not in regular attributes, because those persist to state. Lifecycle Terraform calls up to three methods per operation: Open (required) — fetch or create the value; runs during plan and/or apply whenever the result is needed. There is no state to refresh and nothing to import. Renew (optional) — called when the wall clock passes the RenewAt returned by Open/Renew, for values that expire while Terraform is still running. Renew cannot return a new result — it can only extend/refresh what Open produced (e.g. re-lease the same credential); if the value itself changes on renewal, the API is not renewable in this sense and Open must return a longer-lived value. Close (optional) — called when Terraform is done with the value; revoke leases or delete temporary credentials here. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills hashicorp/provider-ephemeral-resources