terraform-knowledge-patch

To prevent secrets in Terraform state, use ephemeral variables, ephemeral resources, and write-only arguments like _wo attributes. The ephemeralasnull function ensures sensitive values remain unpersisted during state operations across Terraform 1.8 and later.

Structured identity imports in Terraform replace fragile import patterns by using cross-object variable validation and bulk import workflows. This method provides reliable resource identity imports for configurations targeting Terraform 1.8 through 1.15.

OpenTofu and Terraform diverge in state encryption, enabled lifecycle blocks, and const variables. OpenTofu 1.7 through 1.12 includes native state encryption and enabled lifecycle arguments absent in Terraform 1.8 through 1.15.

Terraform Stacks use component-based configurations via HCP for orchestrating multiple deployments, while provider-defined Actions execute day-2 operations. Both features require specific syntax to avoid breaking changes during module refactors.

Yes, this knowledge patch covers Terraform 1.8 through 1.15 and OpenTofu 1.7 through 1.12. It applies to developers authoring modules, provider configurations, imports, ephemeral secrets, Stacks, and provider actions across both tools.

OpenTofu divergences from Terraform include differences in state encryption, const variables, and enabled lifecycle blocks. Use versioned guidance to identify deprecated APIs and unsafe state manipulations when switching between platforms to prevent breakage.