Forum Discussion

Former Member's avatar
Former Member
4 years ago

CLI with Terraform Cloud

When interacting with Terraform services, Terraform expects to find API tokens in CLI configuration files in credentials blocks, for example, a file named .terraformrc
credentials "app.terraform.io" {
token = "xxxxxx.yyyyyyy.zzzzzzzzzzzzz"
}

The above file .terraformrc would be referenced from an environment variable , for example,
❯ echo $TF_CLI_CONFIG_FILE
/Users/xxxxx/projects/terraform/.terraformrc

When I run a terraform plan I would like to pull the token from 1Password using the CLI if that's possible. It seems I could use op inject to potentially do the work but that essentially results in a config file with the hardcoded token.

Would this scenario be possible using the CLI?

Thanks

1Password Version: 8.7.0
Extension Version: 2.0.0
OS Version: macOS 12.3

CLI

2 Replies

  • Former Member's avatar
    Former Member
    4 years ago

    I had already tried this approach and this is when I learnt that TFE_TOKEN is deprecated and cant be used.

    My use-case is to simply move static credentials from the filesystem into 1Password after reading the blog post about ways to use the 1Password CLI with tools like Github and SSH.

  • Former Member's avatar
    Former Member
    4 years ago

    Hey @rbracewe,

    Can you give us more details about your use-case, please?
    Specifically, would it be feasible for you to change the location of your Terraform token? I see that there is a possibility to provision Terraform with the token through an environment variable: TFE_TOKEN. In this situation, I imagine it would possible to set it to a 1Password secret reference and to prefix terraform plan with op run --, or even create an alias for terraform as op run -- terraform in your profile.
    Let me know if this solution can work for you.

    Best,
    Horia