Access HCP Vault Secrets with Terraform

In this example, you will make use of HCP Terraform variable sets, and place all other required parameters in the Terraform configuration. This is done to give you a full picture of the required parameters. You can also choose to set the HCP_CLIENT_ID, HCP_CLIENT_SECRET, and TF_CLOUD_ORGANIZATION variables in your local shell.

1. Retrieve the HCP_CLIENT_ID and HCP_CLIENT_SECRET environment variables set during the Install HCP CLI for Vault Secrets tutorial.

   $ printenv | grep HCP_HCP_CLIENT_ID=aBcDefGx2ruWptclGVpIE7MX7uxkU4HCP_CLIENT_SECRET=S3sAm3stxKjziNhjTWWe9QxEffKyTdiGlxE_suNsh1n3

2. Log into the HCP Terraform portal and select your organization.

3. Select Settings > Variable sets from the left navigation. Variables in HCP Terraform allow you to store items similar to setting an environment variable for a shell session or in a .tfvars file.

4. Click Create variable set.

5. Enter HCP_SERVICE_PRINCIPAL in the Name textbox.

6. Select the Apply globally radio button.

7. Click + Add variable.

8. Enter HCP_CLIENT_ID in the Key field, and the actual client ID in the Value field.

9. Click the Sensitive checkbox, then click Add variable.

10. Click + Add variable again.

11. Enter HCP_CLIENT_SECRET in the Key field, and the actual client secret in the Value field.

12. Click the Sensitive checkbox, then click Add variable.

13. Click Create variable set.

14. Click < Workspaces to return to the Workspace landing page.

15. Click New and select Workspace.

16. Select CLI-driven workflow and enter HCPVaultSecretsLab in the Workspace name field.

17. Scroll to the bottom of the form and click Create workspace.

18. Copy the name of your HCP Terraform organization and return to your terminal session.

19. Set an environment variable with the name of your HCP Terraform organization.

    $ export HCP_ORG=<actual-org-name>

20. Create an example Terraform configuration with the required provider and HCP Terraform configuration block. The HCP Vault Secrets data source requires the hcp provider at version 0.63.0 or greater.

    Note

    This tutorial was tested using version 0.91.0 of the HCP Terraform provider. You can check for the latest version of the provider in the Terraform Registry.

    $ tee terraform.tf <<EOFterraform {  cloud {    organization = "$HCP_ORG"    workspaces {      name = "HCPVaultSecretsLab"    }  }  required_providers {    hcp = {      source = "hashicorp/hcp"      version = "0.91.0"    }  }}provider "hcp" {  # Configuration options  client_id = var.HCP_CLIENT_ID  client_secret = var.HCP_CLIENT_SECRET}EOF

21. Declare the HCP_CLIENT_ID and HCP_CLIENT_SECRET variables in the Terraform configuration.

    $ tee variables.tf <<EOFvariable "HCP_CLIENT_ID" {  type = string}variable "HCP_CLIENT_SECRET" {  type = string}EOF

22. Add the hcp_vault_secrets_app data block to the Terraform configuration to read the WebApplication application you created in an earlier tutorial.

    $ tee main.tf <<EOFdata "hcp_vault_secrets_app" "web_application" {  app_name = "WebApplication"}EOF

23. Add an output block to allow Terraform to display the retrieved secret. This step is not necessary for production configurations, but used in this tutorial to validate that Terraform successfully retrieved the secret.

    Because you will use HCP Vault Secrets to store sensitive information, you must add sensitive = true to the output block.

    $ tee -a outputs.tf <<EOFoutput "secrets" {  value = data.hcp_vault_secrets_app.web_application.secrets  sensitive = true}EOF

24. Log in to HCP Terraform with the login sub-command. Follow the prompts to complete the authentication process.

    $ terraform login---------------------------------------------------------------------------------Terraform must now open a web browser to the tokens page for app.terraform.io.If a browser does not open this automatically, open the following URL to proceed:    https://app.terraform.io/app/settings/tokens?source=terraform-login---------------------------------------------------------------------------------Generate a token using your browser, and copy-paste it into this prompt.Terraform will store the token in plain text in the following filefor use by subsequent commands:    /Users/username/.terraform.d/credentials.tfrc.jsonToken for app.terraform.io:  Enter a value:Retrieved token for user username...snip...

25. Run terraform init to initialize the configuration and install the necessary providers.

    $ terraform initInitializing HCP Terraform...Initializing provider plugins...- Finding hashicorp/hcp versions matching "0.63.0"...- Installing hashicorp/hcp v0.63.0...- Installed hashicorp/hcp v0.63.0 (signed by HashiCorp)Terraform has created a lock file .terraform.lock.hcl to record the providerselections it made above. Include this file in your version control repositoryso that Terraform can guarantee to make the same selections by default whenyou run "terraform init" in the future.HCP Terraform has been successfully initialized!You may now begin working with HCP Terraform. Try running "terraform plan" tosee any changes that are required for your infrastructure.If you ever set or change modules or Terraform Settings, run "terraform init"again to reinitialize your working directory.

26. Run terraform apply to read the WebApplication values from HCP Vault Secrets.

    $ terraform apply -auto-approveRunning apply in HCP Terraform. Output will stream here. Pressing Ctrl-Cwill cancel the remote apply if it's still pending. If the apply started itwill stop streaming the logs, but will not stop the apply running remotely.Preparing the remote apply...To view this run in a browser, visit:https://app.terraform.io/app/your-org/HCPVaultSecretsLab/runs/run-ps3UvBSumbg7c91CWaiting for the plan to start...Terraform v1.5.2on linux_amd64Initializing plugins and modules...data.hcp_vault_secrets_app.WebApplication: Refreshing...data.hcp_vault_secrets_app.WebApplication: Refresh complete after 1s [id=WebApplication]Changes to Outputs:  + secrets = (sensitive value)You can apply this plan to save these new output values to the Terraform state, without changing any real infrastructure.Apply complete! Resources: 0 added, 0 changed, 0 destroyed.Outputs:secrets = (sensitive value)

27. Return to the HCP Terraform portal.

28. On the Overview page you can see the Latest Run is in a stage of Applied.

29. Click See details.

30. Expand Apply finished.

31. Click the State versions created: link.

    The username secret you previously added is displayed.

1. Verify the HCP_CLIENT_ID and HCP_CLIENT_SECRET environment variables for your HCP service principal are set.

   $ printenv | grep HCP_HCP_CLIENT_ID=aBcDefGx2ruWptclGVpIE7MX7uxkU4HCP_CLIENT_SECRET=S3sAm3stxKjziNhjTWWe9QxEffKyTdiGlxE_suNsh1n3

2. Create an example Terraform configuration with the required provider. The HCP Vault Secrets data source requires the hcp provider at version 0.63.0 or greater.

   Note

   This tutorial was tested using version 0.91.0 of the HCP Terraform provider. You can check for the latest version of the provider in the Terraform Registry.

   $ tee terraform.tf <<EOFterraform {  required_providers {    hcp = {      source = "hashicorp/hcp"      version = "0.91.0"    }  }}provider "hcp" {  # Configuration options}EOF

3. Add the hcp_vault_secrets_app data block to the Terraform configuration to read the WebApplication application you created in an earlier tutorial.

   Note

   "web_application" is the name given to the Terraform data source. "WebApplication" is the reference to the specific HCP Vault Secrets app name.

   $ tee main.tf <<EOFdata "hcp_vault_secrets_app" "web_application" {  app_name = "WebApplication"}EOF

4. Add an output block to allow Terraform to display the retrieved secret. This step is not necessary for production configurations, but used in this tutorial to validate that Terraform successfully retrieved the secret.

   Because you use HCP Vault Secrets to store sensitive information, you must add sensitive = true to the output block.

   $ tee outputs.tf <<EOFoutput "secrets" {  value = data.hcp_vault_secrets_app.web_application.secrets  sensitive = true}EOF

5. Run terraform init to initialize the configuration and install the necessary providers.

   $ terraform initInitializing the backend...Initializing provider plugins...- Finding hashicorp/hcp versions matching "0.63.0"...- Installing hashicorp/hcp v0.63.0...- Installed hashicorp/hcp v0.63.0 (signed by HashiCorp)Terraform has created a lock file .terraform.lock.hcl to record the providerselections it made above. Include this file in your version control repositoryso that Terraform can guarantee to make the same selections by default whenyou run "terraform init" in the future.Terraform has been successfully initialized!You may now begin working with Terraform. Try running "terraform plan" to seeany changes that are required for your infrastructure. All Terraform commandsshould now work.If you ever set or change modules or backend configuration for Terraform,rerun this command to reinitialize your working directory. If you forget, othercommands will detect it and remind you to do so if necessary.

6. Run terraform apply to read the WebApplication values from HCP Vault Secrets.

   $ terraform apply -auto-approvedata.hcp_vault_secrets_app.WebApplication: Reading...data.hcp_vault_secrets_app.WebApplication: Read complete after 1s [id=WebApplication]Changes to Outputs:  + secrets = (sensitive value)You can apply this plan to save these new output values to the Terraform state, without changing any real infrastructure.Apply complete! Resources: 0 added, 0 changed, 0 destroyed.Outputs:secrets = <sensitive>

7. Run terraform output secrets to display the secret values.

   $ terraform output secretstomap({  "username" = "db-user"})

   The username secret you previously added is displayed.