{"componentChunkName":"component---src-templates-blog-template-js","path":"/blog/introducing-the-psono-terraform-provider","result":{"data":{"markdownRemark":{"html":"<h1>Introducing the Psono Terraform Provider</h1>\n<p>We are happy to announce that the beta release of the Psono Terraform Provider is now available in the public\n<a href=\"https://registry.terraform.io/providers/psono/psono/latest\">Terraform Registry</a>.</p>\n<p>Infrastructure teams can now manage individual keys inside pre-created Psono Environment Variables entries as part of\ntheir Terraform workflow. The provider can preserve existing values, generate new passwords, rotate managed values, write\nexternally supplied values, and read secrets through Terraform ephemeral resources.</p>\n<h2>Secrets without putting them in Terraform state</h2>\n<p>Secret handling in infrastructure as code needs special care. A sensitive flag can hide a value from normal CLI output,\nbut it does not necessarily keep that value out of Terraform state. The Psono provider uses Terraform's write-only and\nephemeral capabilities to avoid that problem and requires Terraform 1.11 or newer.</p>\n<p>The provider supports three common workflows:</p>\n<ul>\n<li>Generate a value in Psono without returning it through the managed resource.</li>\n<li>Supply a value through a write-only argument so Terraform does not persist it in plan or state.</li>\n<li>Read an existing value through an ephemeral resource and pass it only to another ephemeral or write-only context.</li>\n</ul>\n<p>This makes it possible to include secret lifecycle operations in Terraform while keeping the actual values in Psono.</p>\n<h2>Restricted access and local encryption</h2>\n<p>The provider uses a restricted Psono API key. You assign only the Environment Variables entries that Terraform needs and\ngrant read permission for all operations. Creating, updating, rotating, or deleting keys additionally requires write\npermission. The provider does not need an unrestricted API key and it cannot create vault entries, folders, or datastores.</p>\n<p>Encryption and decryption happen locally in the provider. HTTPS certificate verification cannot be disabled, and private\ncertificate authorities can be added through a PEM CA bundle. Production systems should always use an HTTPS Psono URL.</p>\n<h2>Getting started</h2>\n<p>Terraform 1.11 or newer is required. Add the provider to your Terraform configuration:</p>\n<pre><code class=\"language-hcl\">terraform {\n  required_version = \">= 1.11.0\"\n\n  required_providers {\n    psono = {\n      source  = \"psono/psono\"\n      version = \"~> 1.0\"\n    }\n  }\n}\n\nprovider \"psono\" {}\n</code></pre>\n<p>Configure credentials through environment variables instead of placing them in Terraform files:</p>\n<pre><code class=\"language-bash\">export PSONO_SERVER_URL='https://psono.example.com/server'\nexport PSONO_API_KEY_ID='REPLACE_WITH_API_KEY_ID'\nexport PSONO_API_SECRET_KEY='REPLACE_WITH_API_SECRET_KEY'\n</code></pre>\n<p>Then initialize the working directory:</p>\n<pre><code class=\"language-bash\">terraform init\n</code></pre>\n<p>Terraform downloads the signed provider release and verifies its checksum signature.</p>\n<h2>Generate and rotate values</h2>\n<p>The following resource manages <code>DB_PASSWORD</code> in an existing Psono Environment Variables entry:</p>\n<pre><code class=\"language-hcl\">resource \"psono_environment_variable\" \"database_password\" {\n  secret_id = var.psono_environment_variables_secret_id\n  name      = \"DB_PASSWORD\"\n\n  length      = 32\n  min_lower   = 4\n  min_upper   = 4\n  min_numeric = 4\n  min_special = 4\n\n  rotation_version = 1\n}\n</code></pre>\n<p>If the key already exists, the provider adopts it without changing its value. If it does not exist, the provider generates\nand stores a new value in Psono. The generated value is not returned by the managed resource and does not enter Terraform\nstate.</p>\n<p>Increment <code>rotation_version</code> when Terraform should generate a replacement. This also replaces values that were originally\nadopted or imported, so rotation changes should be reviewed before applying them.</p>\n<h2>Write an externally supplied value</h2>\n<p>An ephemeral value from another provider can be written to Psono with <code>value_wo</code>:</p>\n<pre><code class=\"language-hcl\">ephemeral \"random_password\" \"database\" {\n  length = 32\n}\n\nresource \"psono_environment_variable\" \"database_password\" {\n  secret_id        = var.psono_environment_variables_secret_id\n  name             = \"DB_PASSWORD\"\n  value_wo         = ephemeral.random_password.database.result\n  value_wo_version = 1\n}\n</code></pre>\n<p>The value is available during the Terraform operation but is not stored in plan or state. Increment <code>value_wo_version</code>\nwhen Terraform should write a replacement.</p>\n<h2>Safe deletion by default</h2>\n<p>Destroying a managed resource retains its Psono key by default. This protects values that Terraform adopted but did not\ncreate. Set <code>deletion_policy = \"Delete\"</code> only when Terraform should explicitly remove the key from Psono during destroy or\nresource replacement.</p>\n<h2>Available now</h2>\n<p>The provider is open source and available today:</p>\n<ul>\n<li><a href=\"https://registry.terraform.io/providers/psono/psono/latest\">Install the provider from the Terraform Registry</a></li>\n<li><a href=\"https://doc.psono.com/user/developer/terraform-provider.html\">Read the Psono Terraform Provider guide</a></li>\n<li><a href=\"https://gitlab.com/esaqa/psono/psono-terraform-provider\">View the source code on GitLab</a></li>\n</ul>\n<p>The beta release focuses deliberately on Environment Variables entries and restricted API keys. This keeps permissions\nnarrow, avoids unrestricted vault access, and provides a practical foundation for managing operational secrets safely\nfrom Terraform.</p>","frontmatter":{"date":"August 22, 2026","slug":"introducing-the-psono-terraform-provider","title":"Introducing the Psono Terraform Provider","description":"Manage generated, write-only, and ephemeral values in Psono directly from Terraform without storing secrets in Terraform state.","author":"Sascha Pfeiffer","featuredImage":null}}},"pageContext":{"slug":"introducing-the-psono-terraform-provider","lang":"en","langPathPrefix":""}},"staticQueryHashes":["2149092236","3128451518","3192060438"]}