skills.rest
hashicorp
hashicorpOFFICIAL
Explore all skills by this author →
WebsiteGitHub

provider-configuration

Implement Terraform provider authentication with credential provider chains using the Plugin Framework.

859|125|Updated Nov 8, 2025
Search Tags:#credentials#terraform#Configuration#Authentication#GO#plugin-framework#Provider
One-click install
npx skills add https://github.com/hashicorp/agent-skills --skill provider-configuration
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: provider-configuration
Source: https://github.com/hashicorp/agent-skills/tree/main/plugins/terraform/skills/provider-configuration
Command: npx skills add https://github.com/hashicorp/agent-skills --skill provider-configuration

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Terraform providers often mishandle credential resolution, forcing users to hardcode secrets in configuration or producing confusing "no valid credentials" errors. This Skill guides you through implementing a production-grade authentication layer: an Optional/Sensitive provider schema, an ordered credential provider chain, and diagnostics that tell users exactly what was tried.

Core Features & Use Cases

  • Credential Provider Chain: Resolve credentials in canonical order — static config, environment variables, shared credentials file, platform identity — with a sentinel error distinguishing "nothing supplied" from "misconfigured source".
  • Configure-Time Validation: Guard against unknown values, resolve credentials eagerly in Configure(), and optionally verify them with an identity endpoint so failures surface at plan time.
  • Secret Hygiene & Diagnostics: Redact secrets via String()/GoString(), warn on world-readable credentials files, and emit errors naming every source tried plus a docs URL.
  • Use Case: You are building a Terraform provider for a cloud API and need users to authenticate via provider block, environment variables, or a shared credentials file with named profiles — with unit tests covering precedence, fall-through, and redaction.

Quick Start

Implement the Configure method and credential chain for my Terraform provider so it resolves API credentials from config, environment variables, and a shared credentials file.

Frequently Asked Questions about provider-configuration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement credential resolution in a Terraform provider?▼

Build a credential provider chain that consults sources in order: static provider block config, environment variables, shared credentials file, then platform identity. Each source returns a sentinel ErrNoCredentials when it has nothing to offer, and the chain returns the first complete credential set.

How should Terraform provider schema handle API keys and secrets?▼

Mark every authentication attribute Optional, never Required, so environment-variable and file-based resolution remain possible. Mark secrets Sensitive so Terraform redacts them in plan output, and document the environment variable fallback in each attribute description.

Why does my Terraform provider fail with unknown value errors during plan?▼

During planning, attributes wired to another resource's output are unknown rather than null. Add unknown-value guards in Configure() for each auth attribute so the provider reports a clear error instead of silently falling through the credential chain.

Should Terraform provider credentials resolve as a set or field-by-field?▼

Resolve secrets as a complete set: if a source supplies an API key but no secret, skip that source entirely. Non-secret settings like endpoint or profile can resolve field-by-field across config, environment, and file defaults.

How do I test a Terraform provider credential chain without acceptance tests?▼

Use plain unit tests with an injectable getenv function and t.TempDir() credential file fixtures. Cover per-source behavior, precedence ordering, aggregate error contents, hard errors for explicit missing profiles, and secret redaction in formatted output.

Related Skills

Explore More Software Engineering Skills→
hashicorphashicorp
790

new-terraform-provider

Scaffold a Terraform provider workspace with the Plugin Framework.

Official
Advanced
salafidurussalafidurus
1

prisma-client-api

Reference Prisma Client API for CRUD operations, filters, and relations.

Official
Intermediate
wraithyywraithyy

security-review

Review code for authentication, input validation, and secrets management vulnerabilities.

Community
Advanced
Kisilev13Kisilev13

cloud-iam-deep

Enumerate AWS, Azure, and GCP IAM configurations for credential exploitation vulnerabilities.

Community
Advanced