What problem does it solve?
Terraform providers often need to hand secrets like tokens, generated passwords, and short-lived certificates to configurations without persisting them to state or plan files. This Skill guides the implementation of ephemeral resources in the Terraform Plugin Framework so sensitive values never touch disk.
Core Features & Use Cases
- Lifecycle Implementation: Covers the Open, Renew, and Close methods, including passing lease handles via Private state and setting RenewAt with a safety margin for expiring credentials.
- Schema and Registration Guidance: Explains ephemeral schema design, Sensitive attribute marking, registration via EphemeralResources, and wiring EphemeralResourceData in the provider Configure method.
- Decision Support: Provides a decision table for choosing between an ephemeral resource and a data source, plus design rules that prevent leaking secrets into logs or diagnostics.
- Use Case: A provider needs to issue a short-lived STS-style token that feeds a write-only attribute on another resource. Use this Skill to implement the ephemeral resource with renewal and revocation, then test it through the echoprovider pattern.
Quick Start
Ask the AI to implement a Terraform ephemeral resource that issues a short-lived token for a given role using the Plugin Framework, including renewal and revocation.
