Introducing the Psono Terraform Provider

We are happy to announce that the beta release of the Psono Terraform Provider is now available in the public Terraform Registry.

Infrastructure teams can now manage individual keys inside pre-created Psono Environment Variables entries as part of their Terraform workflow. The provider can preserve existing values, generate new passwords, rotate managed values, write externally supplied values, and read secrets through Terraform ephemeral resources.

Secrets without putting them in Terraform state

Secret handling in infrastructure as code needs special care. A sensitive flag can hide a value from normal CLI output, but it does not necessarily keep that value out of Terraform state. The Psono provider uses Terraform's write-only and ephemeral capabilities to avoid that problem and requires Terraform 1.11 or newer.

The provider supports three common workflows:

• Generate a value in Psono without returning it through the managed resource.
• Supply a value through a write-only argument so Terraform does not persist it in plan or state.
• Read an existing value through an ephemeral resource and pass it only to another ephemeral or write-only context.

This makes it possible to include secret lifecycle operations in Terraform while keeping the actual values in Psono.

Restricted access and local encryption

The provider uses a restricted Psono API key. You assign only the Environment Variables entries that Terraform needs and grant read permission for all operations. Creating, updating, rotating, or deleting keys additionally requires write permission. The provider does not need an unrestricted API key and it cannot create vault entries, folders, or datastores.

Encryption and decryption happen locally in the provider. HTTPS certificate verification cannot be disabled, and private certificate authorities can be added through a PEM CA bundle. Production systems should always use an HTTPS Psono URL.

Getting started

Terraform 1.11 or newer is required. Add the provider to your Terraform configuration:

terraform {
  required_version = ">= 1.11.0"

  required_providers {
    psono = {
      source  = "psono/psono"
      version = "~> 1.0"
    }
  }
}

provider "psono" {}

Configure credentials through environment variables instead of placing them in Terraform files:

export PSONO_SERVER_URL='https://psono.example.com/server'
export PSONO_API_KEY_ID='REPLACE_WITH_API_KEY_ID'
export PSONO_API_SECRET_KEY='REPLACE_WITH_API_SECRET_KEY'

Then initialize the working directory:

terraform init

Terraform downloads the signed provider release and verifies its checksum signature.

Generate and rotate values

The following resource manages DB_PASSWORD in an existing Psono Environment Variables entry:

resource "psono_environment_variable" "database_password" {
  secret_id = var.psono_environment_variables_secret_id
  name      = "DB_PASSWORD"

  length      = 32
  min_lower   = 4
  min_upper   = 4
  min_numeric = 4
  min_special = 4

  rotation_version = 1
}

If the key already exists, the provider adopts it without changing its value. If it does not exist, the provider generates and stores a new value in Psono. The generated value is not returned by the managed resource and does not enter Terraform state.

Increment rotation_version when Terraform should generate a replacement. This also replaces values that were originally adopted or imported, so rotation changes should be reviewed before applying them.

Write an externally supplied value

An ephemeral value from another provider can be written to Psono with value_wo:

ephemeral "random_password" "database" {
  length = 32
}

resource "psono_environment_variable" "database_password" {
  secret_id        = var.psono_environment_variables_secret_id
  name             = "DB_PASSWORD"
  value_wo         = ephemeral.random_password.database.result
  value_wo_version = 1
}

The value is available during the Terraform operation but is not stored in plan or state. Increment value_wo_version when Terraform should write a replacement.

Safe deletion by default

Destroying a managed resource retains its Psono key by default. This protects values that Terraform adopted but did not create. Set deletion_policy = "Delete" only when Terraform should explicitly remove the key from Psono during destroy or resource replacement.

Available now

The provider is open source and available today:

• Install the provider from the Terraform Registry
• Read the Psono Terraform Provider guide
• View the source code on GitLab

The beta release focuses deliberately on Environment Variables entries and restricted API keys. This keeps permissions narrow, avoids unrestricted vault access, and provides a practical foundation for managing operational secrets safely from Terraform.